Strip the active parts out of a document DISARM

The parts of a document that run, and the parts that reach out

A document is not only text. Both major formats can carry things that execute when the file is opened, and things that quietly fetch something from an address the sender chose. DISARM removes both, and lists every removal so you can see what was in there.

From Office files: the VBA macro project, ActiveX controls, embedded OLE objects, references to a remote template, DDE and INCLUDE field codes, and images or objects that load from an external address, which is the ordinary tracking pixel, telling the sender when you opened the document and from where. A macro-enabled file is written back as the plain format, so a .docm leaves as a .docx and cannot be re-armed by accident.

From PDFs: document-level and page-level JavaScript, open actions, launch actions, form-submit actions, embedded files, rich media, file attachment annotations, XFA forms, and optionally the links to web addresses. A PDF that runs JavaScript when it opens is a normal PDF feature that almost no legitimate document needs.

Strip or rebuild

Strip takes the file apart, removes the parts listed above and writes the rest back as it was. Everything it does not recognise stays, byte for byte. That is what keeps the document editable, and it is also its limit: a font built to break the program that reads it, or a picture crafted for an image decoder, is ordinary data to Strip and passes through.

Rebuild works the other way round. Nothing passes unless it is on a list, and everything that passes is written again. An Office file is walked from its root along the references between its parts; only the parts reached that way, and of a kind Rebuild carries (text, styles, sheets, slides, charts, pictures), come across, so a part that nothing in the document refers to is never copied, whatever it holds. Each one is read strictly and written out again, each picture is decoded and encoded again, and embedded fonts are left out. A picture in a format a browser cannot draw (EMF, WMF, TIFF, SVG) is left out too, and a photograph is saved again as JPEG, which loses a little quality.

A PDF is redrawn page by page, with its scripts never run and its own fonts drawn as outlines rather than handed to your computer’s font engine, and each page becomes a picture in a new PDF with the text laid over it, invisible, so it can still be searched and copied. No object of the original is in the new file. The cost is that the text can no longer be edited, and links, form fields, bookmarks and attachments do not come across.

Both say what came out, and both give a record to keep with the file: the SHA-256 of the original and of the new copy, when it was made, what was carried and what was not.

This is not antivirus and does not pretend to be

It is a structural clean: the file is taken apart, the active parts are removed, and it is written back. That deals with the whole category of “this document tries to do something when you open it”, which is how most malicious documents work, and it deals with nothing else.

A document can still lie in its text. An invoice with changed bank details, a letter that is not from who it claims, a spreadsheet whose formulas are wrong on purpose: none of that is active content and none of it is touched, by Strip or by Rebuild. And an exploit in a font parser, an image decoder or the PDF reader's own object handling is not something Strip can see, because the malicious part is ordinary data that happens to break the program reading it. Rebuild does not see it either; it leaves fonts out and redraws pictures and pages, so that what reaches your reader is what this browser drew, not the original’s bytes.

So open unknown files in a viewer you trust, disarmed or not: a browser for a PDF rather than a desktop reader with a large attack surface, a viewer rather than Office for a document you only need to read.

Read it before you strip it, where you can

If you want to know what a macro actually did rather than only that it is gone, MACROLENS shows you the VBA source without Office and without running anything, which is useful when the document came from somebody who says it is legitimate and you would like to be able to say why you believe them.

Related work: X-RAY shows what a file really is whatever its extension claims, STEGOSCAN looks for data hidden inside an image, DOCSCRUB removes the metadata and comments rather than the active content, and CLEANROOM makes one pass over everything before a file goes out.