4 ms·
You can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.
by alexk307 4y ago
You can easily embed arbitrary javascript into any PDF, and you can obfuscate it pretty well enough to get past most endpoint security tools on the market.
- Nextgrid 4y agoThat JS would be sandboxed similar to in browsers, so you'd still need an exploit to break out of that.
- kube-system 4y agoNot too tough, if you're a state backed group. Just buy one. The going price for Adobe PDF RCE zero-days is $80,000
- Jwarder 4y agoIs there a good no-nonsense way to clean PDFs of possible threats? Hunting around I see mentions of converting PDF->Postscript->PDF to remove junk, but I also see mentions that Postscript is its own security mess.
- jabroni_salad 4y agoYour only option is to disable all of those fancy features. That config only lasts until someone needs to file a form with the government though.
- alexk307 4y agoYou’d be best suited making sure your pdf viewer is locked down and doesn’t allow for any js. You could parse your pdf pretty easily and read the sections before you open it, it’s mostly in plaintext
- jabroni_salad 4y agoUnfortunately, there is a scourge of PDFs that download the content after you open them, and have interactive features that should be on websites rather than PDFs. The BSA efiling system has mandatory forms for every bank to fill out, and if they say they say the browser's pdf viewer is no-go and you must configure adobe, that is what you will do. Now every bank in the USA has a hard dependency on adobe reader and a gpo that disables the web browser's built-in pdf reader. Thanks for that, fincen. https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChanges.pdf https://bsaefiling.fincen.treas.gov/docs/BrowserSettingChang... [pdf warning]
- WorldMaker 4y agoYou don't even need JS in a PDF. PostScript remains a Turing Complete language on its own.