3 ms·
I’m assuming it was an exploit in Adobe reader. The target cloud have even been persuaded to install Adobe reader to “e-sign” the document. PDFs don’t have the
by nemothekid 4y ago
I’m assuming it was an exploit in Adobe reader. The target cloud have even been persuaded to install Adobe reader to “e-sign” the document. PDFs don’t have the best track record when it comes to security
- silentsea90 4y agoWhy do pdfs even allow executing code outside of the pdf env ie why isn't there a sandbox/apis that allow very limited operation?
- nemothekid 4y ago>Why do pdfs even allow executing code outside of the pdf env Some PM in 2006 thought it would be a good idea if PDFs were turing complete. I'm sure the word sandbox wasn't even thought about. 10 years later PDF (and more notably, Flash) became huge attack vectors. I think a far more interesting hack is when NSO used a PDF to embed a virtual machine inside an iPhone to develop a zero click exploit over iMessage: https://hothardware.com/news/zero-click-malware-pwns-iphone-virtual-cpu-y2k-image-tech https://hothardware.com/news/zero-click-malware-pwns-iphone-...
- silentsea90 4y agoWhat's the solution? Open pdfs on a VM, and never on your phone?