4 ms·
This is definitely a good brute force strategy I ... think there’s another technique that relies a bit on trusting the printing drivers to do the right thing,
by rtpg 7y ago
This is definitely a good brute force strategy
I ... think there’s another technique that relies a bit on trusting the printing drivers to do the right thing, where you can tell Ghostscript to print your document, and target another PDF. This should at least remove interactive components in a PDF
- userbinator 7y agoIt's definitely brute force, in that it's the equivalent of printing a document onto paper and then scanning it back in. This "flattening" is highly effective at sanitising, but also removes all the semantic content in the process; the output should be several times larger than the input (and if it isn't, then it's an indication that something very suspicious was in the input....)
- necovek 7y agoIndeed, I was hoping for something smarter, that would remove only the "risky" bits of PDF, but keep the overall structure (and size).
- heartbeats 7y agoWhat about converting PDF to PostScript and back? It should keep most of the semantic information while removing the exploits.
- necovek 7y agoYeah, perhaps. The "gruntwork" would be to figure out if that is sufficient. Heck, taking your idea further, perhaps convert to something non-derivative like HP's PCL5 and back. Or SVG or...
- est31 7y agoIIRC this is also how Firefox is doing it for its pdf.js print feature: https://github.com/mozilla/pdf.js/blob/master/web/pdf_print_service.js https://github.com/mozilla/pdf.js/blob/master/web/pdf_print_... Which is why when you print a PDF from Firefox, it doesn't look very nice. But it's safer than sending unsanitized PDFs to printers.
- HeavenFox 7y agoI used to deal with PDF at my day job. Among all the tools we use in production, Ghostscript probably has the most 0 day. Thankfully we're paranoid about security and run everything in sandbox. Still it's no fun getting nagged by security to upgrade our Ghostscript version.
- cjbprime 7y agoIt's funny how they all seem to have been found by one person (Tavis Ormandy) too. It's like the setup and PostScript standard are so baroque that only one human understands them, and that human takes a week or so every year or two to research and drop another 0day. https://bugs.chromium.org/p/project-zero/issues/detail?id=1640 https://bugs.chromium.org/p/project-zero/issues/detail?id=16...
- deleted 7y ago[deleted]
- ageitgey 7y agoHonestly it is starting to feel like most major exploits in most major software/platforms are being found by Tavis Ormandy these days. He's really good at what he does.
- NKCSS 7y agoWell, Tavis is one of the infosec superstars, the amount of stuff he comes up with is amazing.
- tptacek 7y agoBe very wary of exposing Ghostscript to untrusted data.