5 ms·

> Is injecting malware into PDFs still a thing? Nope. Most people read PDFs inside the browser, with the same sandbox protections as other web content.

by lima 5y ago

tgsovlerkhgsel 5y ago
IIRC Firefox uses a JavaScript based PDF reader (pdf.js), but Chrome/Chromium uses a native library (PDFium). Both have had exploits in the past, but I would trust the pdf.js approach more.
cf141q5325 5y ago
Sandboxes can be escaped from.
- faeyanpiraat 5y ago
  You can only get guaranteed protection from malware infections through the internet if you turn off your machine. Even then there might be some remote management exploits which would work on turned off machines, so unplug the cables aswell.
  - cf141q5325 5y ago
    Thats not a reason to fudge with the definitions. The existence of sandboxes doesnt mean there are no more pdf exploits. There still are and sandboxes dont mitigate it entirely. There is also more ways then just turning off your machine. Its needlessly oversimplifying complex topics. Topics that are very interesting and have severe implications. Especially if we are talking about state level espionage. So in short, no you are wrong. PDF exploits are still a thing. You made unjustified assumptions. Reading my post it sounds confrontational. Thats not my intent.
    - faeyanpiraat 5y ago
      I only confirmed what you said. The best way to reduce the number of bugs (exploits) in a system is to get rid of it. Since you've brought up state level espionage, this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course).
      - cf141q5325 5y ago
        >this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course). Nice point, thanks for bringing it up. Reminded me of https://www.theguardian.com/world/2013/jul/11/russia-reverts-paper-nsa-leaks https://www.theguardian.com/world/2013/jul/11/russia-reverts... >Russian guard service reverts to typewriters after NSA leaks

> Is injecting malware into PDFs still a thing? Nope. Most people read PDFs inside the browser, with the same sandbox protections as other web content.

by lima 5y ago

> Is injecting malware into PDFs still a thing? Nope. Most people read PDFs inside the browser, with the same sandbox protections as other web content.

tgsovlerkhgsel 5y ago

IIRC Firefox uses a JavaScript based PDF reader (pdf.js), but Chrome/Chromium uses a native library (PDFium). Both have had exploits in the past, but I would trust the pdf.js approach more.

cf141q5325 5y ago

Sandboxes can be escaped from.

faeyanpiraat 5y ago
You can only get guaranteed protection from malware infections through the internet if you turn off your machine. Even then there might be some remote management exploits which would work on turned off machines, so unplug the cables aswell.
- cf141q5325 5y ago
  Thats not a reason to fudge with the definitions. The existence of sandboxes doesnt mean there are no more pdf exploits. There still are and sandboxes dont mitigate it entirely. There is also more ways then just turning off your machine. Its needlessly oversimplifying complex topics. Topics that are very interesting and have severe implications. Especially if we are talking about state level espionage. So in short, no you are wrong. PDF exploits are still a thing. You made unjustified assumptions. Reading my post it sounds confrontational. Thats not my intent.
  - faeyanpiraat 5y ago
    I only confirmed what you said. The best way to reduce the number of bugs (exploits) in a system is to get rid of it. Since you've brought up state level espionage, this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course).
    - cf141q5325 5y ago
      >this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course). Nice point, thanks for bringing it up. Reminded me of https://www.theguardian.com/world/2013/jul/11/russia-reverts-paper-nsa-leaks https://www.theguardian.com/world/2013/jul/11/russia-reverts... >Russian guard service reverts to typewriters after NSA leaks