Everything Stays Local
Document malware, and sanitising it without uploading anything.
Slides
Presents in the browser — arrow keys, space or click to advance,
f for full screen.
Present → Everything Stays Local
25 slides · the five families of document-borne
execution, why the usual defences fit badly, and the demonstrations that
show it against real files rather than describing it
Or take the PDF, or the
PowerPoint.
Code
Download → applications and scripts
the tool itself, entries.py and the scripts
that build and test it, the Python sanitiser it was ported from, and
Didier Stevens’ pdfid.py and oledump.py
bundled with hashes and provenance
Paper
Read → companion paper
9 pages · the same material argued rather than asserted —
the full PDF action table, where the tool deliberately disagrees with the
sanitiser it was ported from, and the implementation mistakes with enough
context to be useful
Tools used in the demonstrations
Linked rather than bundled. These are other people’s tools, and you
want the current version from the author, not a copy frozen inside a talk.
pdfid.py
— Didier Stevens. Counts the PDF names that mean “do” rather than
“draw”, and the origin of the length-preserving disarm this tool
implements.
(source)oledump.py
— Didier Stevens. Walks OLE2 streams and dumps them.
(source)olevba / oletools
— Philippe Lagadec. Extracts and deobfuscates VBA.
pip install oletoolsmutool — MuPDF
— Artifex. Used as an independent second opinion on a rewritten PDF:
checking output with the parser that produced it proves only that it
agrees with itself.- LibreOffice
— for the “convert it and re-scan the copy” advice given for
legacy formats this tool deliberately does not rewrite.
entries.py
— per-entry triage of a ZIP-based document: size, compression
method, entropy and magic, one row per part. The only tool here with no
upstream to link — it ships in the archive above.unzip, xxd, file, strings,
grep, sha256sum — your distribution’s.
On Debian or Ubuntu:
apt install unzip xxd file binutils mupdf-tools
What the talk covers
- Why a document is a container format with an execution surface, not a picture of information
- Macro code, embedded objects, remote fetch, reader features, legacy containers — and the artifact each one leaves
- Remote template injection: a file that is malicious while containing nothing malicious
- Why uploading a suspicious document to ask whether it is dangerous publishes it
- The length-preserving PDF disarm, and why byte-identical output is the canary for rewriter correctness
- Capability naming: saying what a document tries to do — auto-execute, launch, download, persist — without shipping a signature corpus
- Reading the macro rather than the crumbs: MS-OVBA decompression, and why
strings on a maldoc never shows a whole procedure
- Content dispatch: why routing on the file extension fails open on the oldest trick there is
- Verify-after-scrub — the plan says what it meant to remove; only a re-scan says what the output contains
- What the tool does not do
The tool
Toilet Duck Web is a single index.html. It opens from disk, has no
dependencies, and makes no network requests — the files you scan never
leave the machine.
toiletduck.cleaning