4 ms·
Hah a PDF! Nice try, folks...
by cyberpunk 10y ago
Hah a PDF!
Nice try, folks...
- matthewmacleod 10y agoYou know that PDFs aren't unsafe, right?
- tomelders 10y agoThis is a PDF from GCHQ we're talking about.
- matthewmacleod 10y agoThat makes literally no sense.
- conjectures 10y agoIt literally makes sense. Do you mean to say it is paranoid?
- matthewmacleod 10y agoNo. The origin of a PDF has no relation to the security or otherwise of the format.
- eterm 10y agoBut the viewer does matter. If I view using pdf.js, then not only does the "format" need to be unsecure (whatever that means), but it would require a browser vulnerability that's exploitable through javascript. At which point why go through the charade of a PDF at all?
- tomelders 10y agounless there's an exploit that we don't know about yet.
- us0r 10y agoUse the github viewer?
- pjc50 10y agohttp://www.malwaretracker.com/pdfthreat.php http://www.malwaretracker.com/pdfthreat.php http://security.stackexchange.com/questions/64052/can-a-pdf-file-contain-a-virus http://security.stackexchange.com/questions/64052/can-a-pdf-...
- matthewmacleod 10y agoYeah, those are vulnerabilities in some PDF readers. Different deal.
- pjc50 10y agoThat's a bit no-true-Scotsman? There's a history of PDF exploits that have made people wary. The exploits are delivered in the PDF, therefore some PDFs are 'unsafe'. (As other comments have said, we shouldn't take "omg gchq are going to serve me an exploit PDF" too seriously, but there have been incidents of security services using PDF exploits to spear-phish people) Edit: an example bank PDF exploit is mentioned in: http://ftalphaville.ft.com/2016/05/13/2161789/how-to-steal-a-cyber-billion-swiftly/ http://ftalphaville.ft.com/2016/05/13/2161789/how-to-steal-a...
- matthewmacleod 10y agoThat's true, only in the sense that all software ever published may have vulnerabilities, meaning there is no format which is 'safe'. That's fine, if that's your definition, but it's obviously useless for comparison.
- geofft 10y agoNo, it's not useless, if you don't round off to a binary "could have vulnerabilities". Many PDF readers have had many vulnerabilities; this is a historical fact. It's much less likely that e.g. some Markdown rendered to HTML by GitHub will have a zero-day.
- dkopi 10y agoAssuming they have a zero day vulnerability in acrobat (or other PDF readers), they wouldn't risk losing it by uploading a file with an exploit, using their own name, and in a wide distribution. When the GCHQ wants to hack you, it won't be on GitHub. It will be a file served specifically to your computer, with content relevant specifically for you, from someone you trust and don't suspect.