Using PDF files from dubious sources

Question

In one of my university courses, the lecture materials (solutions to homework assignments) are not fully supplied by the university itself, but have to be created by the students themselves: The students create a pdf with the solution and distribute it via moodle.

Since I don't know how trustworthy these students are, I'm worrying that some of their pdf's might contain malware.

I'm using a windows 10 machine with a VBox that runs Ubuntu 18: Is there any safe way how I can use these - potentially malicious - pdf's with my setup (e.g. by converting them to a png via pdftoppm)?

Answer 1

Yes you should be safe to open and view the PDF's within a Virtual Machine, here are some considerations though.

• Use the latest version of Oracle Virtualbox as there have been exploits to escape the host machine for example https://www.exploit-db.com/exploits/43878.
• A PDF can be used to leak your IP address once opened https://docs.canarytokens.org/guide/adobe-pdf-token.html.
• Unless one of your students have found an exploit within your chosen PDF reader and machine virtualization software you should be fine!