Encoding malicious PDFs as XDP files to bypass anti-virus? No need to panic

GovCertUK, the UK Government’s Computer Emergency Response Team, issued an alert yesterday about how attackers could bypass gateway anti-virus software to infect organisations, by encoding malicious PDF files into the XDP format.

XDP is an XML-based file format which includes the PDF as a Base64-encoded data stream. If you open an XDP file with Adobe Reader, it will be opened just like an ordinary PDF file, and potentially infect your computer with malware.

The truth is, however, that there is little to fear if your computers are protected by up-to-date anti-virus software.

When you open an XDP file on your computer, the embedded PDF file is written to your hard drive before it is rendered.

At the point that the PDF is accessed for rendering, your on-access scanner should scan the PDF as normal, successfully detecting it if it’s a piece of malware that the anti-virus knows about.

In short, good anti-virus software like Sophos does prevent XDPs containing embedded PDF…

Read more in my article on the Naked Security website.

Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy. Follow him on Twitter at @gcluley, on Mastodon at @[email protected], or drop him an email.