• Users seeking free file conversion targeted by malware.
• FBI posts warning against use.
• Verifiable and reliable open-source tools to convert files quickly.

The multiplicity of file types that many people come across in their working days means that often, it’s necessary or convenient to convert a document of one type to another.

In some cases, it’s a simple procedure done inside the application – ‘printing’ a document to PDF, or using the Save As… menu item in common applications, and choosing the required destination file type.

The dangers of free file conversion

Beyond those possibilities, things can potentially get dangerous, according the FBI’s Denver field office. It’s published a notice that some free online document converter tools create converted documents that contain malware designed to access the victim’s computer.

“These converters and downloading tools will do the task advertised, but the resulting file can contain hidden malware giving criminals access to the victim’s computer,” the notice states. It says that its agents have noticed an increase of instances in which bad actors set up websites offering file conversion, or tools for users to download and run locally.

The infected, converted files can contain code that scrapes personally identifiable information, including name, date of birth, etc., banking details, cryptocurrency wallet details, and passwords. In some cases, the affected files contain cryptocurrency miners that use victims’ computers hardware to generate currencies such as Monero using the infected machine.

In many instances on the modern internet, the saying goes that “if something is free, you are the product.” And that’s especially true when bad actors can target unwary workers in a hurry to complete a task seemingly as simple as file conversion.

Although there are reputable companies that offer free file conversion services and applications, it’s worth noting that the tools used by bad actors behind bogus services are highly likely to use readily-available software to undertake the file conversion, and then infect each converted file with malicious code, before offering it ‘ready’ to download.

How can I convert files without risk of malware?

The bare conversion software – that is, the application that converts from file type A to file type B – is freely-available, easy to download, and more importantly in this context, its contents can be verified by examining its source code.

For example, a popular utility that’s a veritable Swiss Army knife of text file conversion is pandoc, available here, as is its source code. There’s even a limited online implementation of the software. But users may wish to download and run the application on their own machines (it runs on macOS, Windows, Linux, Chrome OS, and BSD).

The software is licensed under GPL-2.0 (GNU General Public License) and can be freely-distributed, modified and redistributed (under certain terms), and is also free in terms of cost. If you use pandoc to any degree, you should consider donating (time or money) to the project. Pandoc converts files from any of 45 types to over 60 destination types, including the ubiquitous .docx, .doc, and .pdf formats.

For those wishing to write to, or extract text from PDF files (which are based on encapsulated postscript, the language printers ‘speak’), we recommend the Poppler tools. The various Poppler utilities run on Linux and Mac – via HomeBrew – and there are variants that will run on Windows and in a Docker or Podman container. Like pandoc, and much of the software that runs the world, Poppler is open-source and free to use, albeit coming with the repeated suggestion of donating in some way to the project’s maintainers, who, like the majority of open-source developers, are not paid for their work.

To give readers some idea of the speed and efficiency of Poppler, pandoc, and similar tools, conversion of this article’s contents into .html ready for publication took just 0.07 seconds. Extracting the text content of a 6-page PDF from the FBI’s website took 0.108 seconds (using pdf2txt, one of the Poppler utilities), and converting the same PDF into a .jpeg image files (using ImageMagick) took just 0.26 seconds.

Some end users may prefer the convenience of a swiftly-located, free file conversion online service, but it’s an unfortunate fact of cybersecurity that humans’ propensity for an easy life leads to many, if not most incidents of malware infection. By taking a little more time and trouble to locate, verify, and install software that can be trusted, end-users can remove themselves from bad actors’ low-hanging fruit categories.

File conversion for the properly-equipped and aware user is a trivial matter. Unfortunately, the same triviality applies to the work involved in setting up a ‘free’ conversion and infection website that catches the unwary.