I know infected documents in windows have file extension of .pdf.exe or .jpg.exe . Can you infect a file without changing extension? Is it the same in linux?

  • 1
    Strictly there is no extension in posix/unix/linux (including osx). The '.pdf' at the end of the file is just the end-part of the filename. A file's data itself provides the clue as to what's in the file, not the name. You can file filespec to have the system peek inside the file 'filespec' & it'll respond with the type of file. – guiverc Feb 11 '19 at 11:26
  • If you are able to detect at all that a document or picture is infected, then the workmanship seems poor. Well-made malware can be very, very difficult to detect. – user535733 Feb 11 '19 at 12:48

Those "infected documents" aren't and never have been documents. They are executable files, just like any other app on your computer. However they appear as documents at first glance on a system which does not show file extensions.

As guiverc pointed out, file extensions usually don't mean much on Linux.

Real infected documents use exploits and weaknesses either in the file format itself or the software that the file is opened with. PDFs can have attachments from which an attack can be launched. A quick Google search yielded this page which explains this attack vector: https://leotindall.com/post/pdf-embedding-attacks/

Not the answer you're looking for? Browse other questions tagged or ask your own question.