4 ms·
I don’t think you got the idea of what I am saying. You can’t limit people to opening only PDFs which you approved. Therefore if a PDF reader has an exploit (b
by heavenlyblue 6y ago
I don’t think you got the idea of what I am saying.
You can’t limit people to opening only PDFs which you approved. Therefore if a PDF reader has an exploit (be it ability to write to it’s code locations via PDF payload, a scripting language embedded writhin PDF), then you are pwned.
EXE files are far from the only files that allow you to embed code today. Heck, you can embed JS in an SVG image and if you’re unlucky to display that with some not-so-smart image previewed then you’re done.
Fingerprinting is useless for that kind of stuff because it takes away the only good use of computers: sharing of new, unique information.
- tgsovlerkhgsel 6y agoAs I said, exploits are out of scope for binary (i.e. executable) whitelisting and a malicious document could be opened even with binary whitelisting in place and would bypass it - but they're rare in practice. It raises the bar for the attacker from "trick the user into running your malware" to "have a zero-day for your PDF reader + an escape for whatever sandbox the reader may be put into + fileless malware to actually do something useful after they gained initial execution on the target machine". Again, not claiming it's unbreakable, but it stops the vast majority of attacks (allowing you to spend time defending against the rest instead of reimaging machines infected with commodity malware).