4 ms·

PDFs in .zip files is in itself a huge smell to begin with. I don't think I've actually ever received a zipped up .pdf, so it's clearly not legitimately necess

PDFs in .zip files is in itself a huge smell to begin with. I don't think I've actually ever received a zipped up .pdf, so it's clearly not legitimately necessary for anyone to do so and should you ever see it you should treat it highly suspiciously. I get admin@ emails for our company domain and there is a somewhat steady stream of run of the mill fraud attempts. A trick I've seen happen quite a lot recently is emails with .svg attachments, which have some lightly obfuscated JavaScript in them and which ultimately redirects you to some dodgy looking URL (which I never visited). I simply made a rule to outright reject all .svg files from external sources and I get a report any time it's attempted. In about the last 12 months this has been running, it's probably blocked about 20 incoming emails and only one of those was a false positive and even the false positive was a weird case as we were sending a .svg file to a creative company who for some reason had our .svg attachment in their reply back to us.

Joker_vD 1y ago
Well, there is a case for PDFs in a .zip, but it's when you're e.g. downloading some set of documents from your e-government site, and it's like 4 PDFs, all cryptographically signed: so you get a .zip with 4 PDFs in it and 4 .sig files with matching names. But in emails? Just attach however many PDFs you need and send, they don't really compress anyway; and I think most web-mail fronts actually allow you to download all the attachments as a single .zip — but obviously those .zip-files are not maliciously crafted (I hope, at least). Also, now that I think of it, forwarding the PDF you've extracted and visually reviewed instead of the original .zip-file would defeat this attack (unless, of course, it's the PDF file that's schizophrenic).
- b112 1y ago
  The other reason is to use zip's incredibly mega super secure password protection, to keep super secret docs safe. (I see it all the time. Along with the password in the very same email)
  - gcarvalho 1y ago
    I’m not saying this is good security hygiene, but not necessarily everyone with access to the file will also have access to the password in the email. e.g. someone downloaded the password protected zip on a public computer, logged out of their email, but forgot to delete the file.
  - blincoln 1y ago
    This is often a useful practice, because it prevents providers' badly-written/-configured attempts at antimalware from blocking files that the recipient knows they want to accept.
justin66 1y ago
> I don't think I've actually ever received a zipped up .pdf, so it's clearly not legitimately necessary for anyone to do so and should you ever see it you should treat it highly suspiciously. What kind of crazy logic is that?
- nijave 1y ago
  Not sure... S.O. is an accountant and they're constantly emailing zips of Excel files and PDFs. Most of the monthly financials are a handful of different reports and they all get zipped together and emailed around. I'm sure there's other common reporting use cases as well

Joker_vD 1y ago

Well, there is a case for PDFs in a .zip, but it's when you're e.g. downloading some set of documents from your e-government site, and it's like 4 PDFs, all cryptographically signed: so you get a .zip with 4 PDFs in it and 4 .sig files with matching names. But in emails? Just attach however many PDFs you need and send, they don't really compress anyway; and I think most web-mail fronts actually allow you to download all the attachments as a single .zip — but obviously those .zip-files are not maliciously crafted (I hope, at least). Also, now that I think of it, forwarding the PDF you've extracted and visually reviewed instead of the original .zip-file would defeat this attack (unless, of course, it's the PDF file that's schizophrenic).

b112 1y ago
The other reason is to use zip's incredibly mega super secure password protection, to keep super secret docs safe. (I see it all the time. Along with the password in the very same email)
- gcarvalho 1y ago
  I’m not saying this is good security hygiene, but not necessarily everyone with access to the file will also have access to the password in the email. e.g. someone downloaded the password protected zip on a public computer, logged out of their email, but forgot to delete the file.
- blincoln 1y ago
  This is often a useful practice, because it prevents providers' badly-written/-configured attempts at antimalware from blocking files that the recipient knows they want to accept.

justin66 1y ago

> I don't think I've actually ever received a zipped up .pdf, so it's clearly not legitimately necessary for anyone to do so and should you ever see it you should treat it highly suspiciously. What kind of crazy logic is that?

nijave 1y ago
Not sure... S.O. is an accountant and they're constantly emailing zips of Excel files and PDFs. Most of the monthly financials are a handful of different reports and they all get zipped together and emailed around. I'm sure there's other common reporting use cases as well