Encoding malicious PDFs as XDP files to bypass anti-virus? No need to panic

Filed Under: Adobe, Featured, Malware, PDF, Vulnerability

GovCertUK, the UK Government's Computer Emergency Response Team, issued an alert yesterday about how attackers could bypass gateway anti-virus software to infect organisations, by encoding malicious PDF files into the XDP format.

Alert from GovCertUK

XDP is an XML-based file format which includes the PDF as a Base64-encoded data stream. If you open an XDP file with Adobe Reader, it will be opened just like an ordinary PDF file, and potentially infect your computer with malware.

The truth is, however, that there is little to fear if your computers are protected by up-to-date anti-virus software.

XDP fileWhen you open an XDP file on your computer, the embedded PDF file is written to your hard drive before it is rendered.

At the point that the PDF is accessed for rendering, your on-access scanner should scan the PDF as normal, successfully detecting it if it's a piece of malware that the anti-virus knows about.

In short, good anti-virus software like Sophos does prevent XDPs containing embedded PDF malware from being actively infectious on your PC - we detect and correctly prevent access.

We haven't rested on our laurels, of course. As there's been a level of concern about this, SophosLabs experts have updated our product to also scan directly inside the XDP file format - meaning that we can also intercept any file's attempt to slip a malicious PDF past gateway scanners.

, , , , ,

You might like

4 Responses to Encoding malicious PDFs as XDP files to bypass anti-virus? No need to panic

  1. Rik_K · 1204 days ago

    Another good reason to run your internet facing apps within a sandbox etc.

  2. So, Sophos disagrees with the Brandon Dixon's findings (http://blog.9bplus.com/av-bypass-for-malicious-pdfs-using-xdp) that none of 42 antivirus tested detected the bad PDF, including Sophos'?

    His most recent list update (June 20) only shows 3 vendor detections - and still doesn't list Sophos with a positive detection.

    • I suspect that there might be an error with Brandon's testing methodology.

      A valid test would be take some PDF malware that all the anti-virus products *are* detecting, convert it to an XDP file, and then open the resulting XDP file on a computer with the anti-virus enabled. (Of course, you would have to do this for each anti-virus product. It takes a while, but that's a proper way to test if the products can deal with the issue in the real world, rather than with VirusTotal)

      As the products detect the malware in the files when they are PDF format, they should also pick them up when they are in XDP format.

      If you have any XDP files that you believe are infected with PDF malware and that you think Sophos is not detecting, please send a sample to our labs. You can use the form at https://secure2.sophos.com/en-us/support/contact-...

      Hope that helps

  3. So UK Gov runs a CERT for itself and not for the whole nation? Shame. Another mixed signal on whether IT security is of national importance or not.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at https://grahamcluley.com, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley