5 ms·

They say that a worker downloading (and presumably viewing) a PDF (fake job offer) allowed spyware in. Which PDF viewer was exploited?

snickerbockers 4y ago
im guessing it was the ol' ".pdf.exe" trick.
- hn_throwaway_99 4y ago
  That trick doesn't work anymore for any reasonably modern email client.
  - snickerbockers 4y ago
    That's when you remind him that your boss needs to get this role filled by the end of the week so if you don't get a response by tomorrow you'll have no choice but to offer the job to another candidate.
  - silverPoodle 4y ago
    You can put it into a .zip archive or just send an email containing a link with a fake PDF
  - bfgoodrich 4y ago
- j0hnyl 4y ago
  You're downvoted, but I'm certain this is exactly what it is.
- Hamuko 4y ago
  This sounds way too sophisticated for them to risk it with a "Offer.pdf.exe". Especially if it was state-backed. If the victim notices it, and the bar isn't high, you'd basically spook him away and alert the entire company.
samatman 4y ago
To quote Fight Club: a major one.
alexk307 4y ago
You can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.
- Nextgrid 4y ago
  That JS would be sandboxed similar to in browsers, so you'd still need an exploit to break out of that.
  - kube-system 4y ago
    Not too tough, if you're a state backed group. Just buy one. The going price for Adobe PDF RCE zero-days is $80,000
- Jwarder 4y ago
  Is there a good no-nonsense way to clean PDFs of possible threats? Hunting around I see mentions of converting PDF->Postscript->PDF to remove junk, but I also see mentions that Postscript is its own security mess.
  - jabroni_salad 4y ago
    Your only option is to disable all of those fancy features. That config only lasts until someone needs to file a form with the government though.
    - alexk307 4y ago
      You’d be best suited making sure your pdf viewer is locked down and doesn’t allow for any js. You could parse your pdf pretty easily and read the sections before you open it, it’s mostly in plaintext
      - jabroni_salad 4y ago
        Unfortunately, there is a scourge of PDFs that download the content after you open them, and have interactive features that should be on websites rather than PDFs. The BSA efiling system has mandatory forms for every bank to fill out, and if they say they say the browser's pdf viewer is no-go and you must configure adobe, that is what you will do. Now every bank in the USA has a hard dependency on adobe reader and a gpo that disables the web browser's built-in pdf reader. Thanks for that, fincen. https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChanges.pdf https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChang... [pdf warning]
Nextgrid 4y ago
I'm not sure it was even an exploit. It could very well be an intentionally-malformed PDF that pretends it has to be opened in a special "viewer" software, maybe even Adobe- or DocuSign-branded.

snickerbockers 4y ago

im guessing it was the ol' ".pdf.exe" trick.

hn_throwaway_99 4y ago
That trick doesn't work anymore for any reasonably modern email client.
- snickerbockers 4y ago
  That's when you remind him that your boss needs to get this role filled by the end of the week so if you don't get a response by tomorrow you'll have no choice but to offer the job to another candidate.
- silverPoodle 4y ago
  You can put it into a .zip archive or just send an email containing a link with a fake PDF
- bfgoodrich 4y ago
j0hnyl 4y ago
You're downvoted, but I'm certain this is exactly what it is.
Hamuko 4y ago
This sounds way too sophisticated for them to risk it with a "Offer.pdf.exe". Especially if it was state-backed. If the victim notices it, and the bar isn't high, you'd basically spook him away and alert the entire company.

samatman 4y ago

To quote Fight Club: a major one.

alexk307 4y ago

You can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.

Nextgrid 4y ago
That JS would be sandboxed similar to in browsers, so you'd still need an exploit to break out of that.
- kube-system 4y ago
  Not too tough, if you're a state backed group. Just buy one. The going price for Adobe PDF RCE zero-days is $80,000
Jwarder 4y ago
Is there a good no-nonsense way to clean PDFs of possible threats? Hunting around I see mentions of converting PDF->Postscript->PDF to remove junk, but I also see mentions that Postscript is its own security mess.
- jabroni_salad 4y ago
  Your only option is to disable all of those fancy features. That config only lasts until someone needs to file a form with the government though.
  - alexk307 4y ago
    You’d be best suited making sure your pdf viewer is locked down and doesn’t allow for any js. You could parse your pdf pretty easily and read the sections before you open it, it’s mostly in plaintext
    - jabroni_salad 4y ago
      Unfortunately, there is a scourge of PDFs that download the content after you open them, and have interactive features that should be on websites rather than PDFs. The BSA efiling system has mandatory forms for every bank to fill out, and if they say they say the browser's pdf viewer is no-go and you must configure adobe, that is what you will do. Now every bank in the USA has a hard dependency on adobe reader and a gpo that disables the web browser's built-in pdf reader. Thanks for that, fincen. https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChanges.pdf https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChang... [pdf warning]

Nextgrid 4y ago

I'm not sure it was even an exploit. It could very well be an intentionally-malformed PDF that pretends it has to be opened in a special "viewer" software, maybe even Adobe- or DocuSign-branded.