Encoding malicious PDFs as XDP files to bypass anti-virus? No need to panic

GovCertUK, the UK Government’s Computer Emergency Response Team, issued an alert yesterday about how attackers could bypass gateway anti-virus software to infect organisations, by encoding malicious PDF files into the XDP format.

Alert from GovCertUK

XDP is an XML-based file format which includes the PDF as a Base64-encoded data stream. If you open an XDP file with Adobe Reader, it will be opened just like an ordinary PDF file, and potentially infect your computer with malware.

The truth is, however, that there is little to fear if your computers are protected by up-to-date anti-virus software.

Sign up to our free newsletter.
Security news, advice, and tips.

XDP fileWhen you open an XDP file on your computer, the embedded PDF file is written to your hard drive before it is rendered.

At the point that the PDF is accessed for rendering, your on-access scanner should scan the PDF as normal, successfully detecting it if it’s a piece of malware that the anti-virus knows about.

In short, good anti-virus software like Sophos does prevent XDPs containing embedded PDF malware from being actively infectious on your PC – we detect and correctly prevent access.

We haven’t rested on our laurels, of course. As there’s been a level of concern about this, SophosLabs experts have updated our product to also scan directly inside the XDP file format – meaning that we can also intercept any file’s attempt to slip a malicious PDF past gateway scanners.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.