4 ms·
Why do pdfs even allow executing code outside of the pdf env ie why isn't there a sandbox/apis that allow very limited operation?
by silentsea90 4y ago
Why do pdfs even allow executing code outside of the pdf env ie why isn't there a sandbox/apis that allow very limited operation?
- nemothekid 4y ago>Why do pdfs even allow executing code outside of the pdf env Some PM in 2006 thought it would be a good idea if PDFs were turing complete. I'm sure the word sandbox wasn't even thought about. 10 years later PDF (and more notably, Flash) became huge attack vectors. I think a far more interesting hack is when NSO used a PDF to embed a virtual machine inside an iPhone to develop a zero click exploit over iMessage: https://hothardware.com/news/zero-click-malware-pwns-iphone-virtual-cpu-y2k-image-tech https://hothardware.com/news/zero-click-malware-pwns-iphone-...
- silentsea90 4y agoWhat's the solution? Open pdfs on a VM, and never on your phone?