7 ms·

I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Ra

by abirch 4y ago

I still can't believe that they opened the PDF on the company computer. I always use my home computer and the poor hacker would get bored of seeing all of my Raspberry Pi projects that I haven't done.

kuboble 4y ago
It might be hard to believe that the particular person in a particular company did that, but given a lot of attempts, dedication and lucky / unlucky circumstances eventually somewhere someone will trust a malicious person and will get socially engineered into opening a pdf on a working computer.
- godot 4y ago
  Also wonder if the PDF exploit works for only local/native PDF readers (e.g. Adobe Readers) or also web-based. If someone occasionally checks their personal email from a work laptop, chances are they'd only use the Gmail preview to open the PDF. It seems like most engineers wouldn't get all the way to downloading a job offer PDF to their work laptop and opening it up there.
CrispinS 4y ago
I can't believe a software developer is using an operating system/pdf viewer that isn't patched for security vulnerabilities as major as an RCE. Unless this was a zero day, but I would have assumed the article would mention that fact ..
- pcthrowaway 4y ago
  I really wish we had details here too, but someone made a good point: "Hey, you need a PDF viewer with scripts enabled for the digital signing.. can you install Adobe XXX?" would be a good line to get the mark to use a less-than-secure PDF viewer. But also, since it was the North Korea hacking group, I'm not ruling out a 0-day... hopefully more details will come at some point.
da39a3ee 4y ago
Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.
- jazzyjackson 4y ago
  lol do you at least dual boot? have a separate user account? I guess its fine as long as your computer doesn't have the credentials to the company slush fund. Friend of mine I traveled with carried 3 macbooks with her: school issued, work issued, and personal. They had different software licenses tied to the machine, whadyagonnado?
- RajT88 4y ago
  I travel with a HP Spectre x360 for personal stuff. It is barely a weight or bulk addition compared to my work machine. When I was on the road all the time I also had separate phones to ensure I never got stuck with a dead phone.
- logifail 4y ago
  > I've used my company laptops for my personal life for the last 15 years. Counterpoint: I've been completely and utterly allergic to opening anything personal from any company system for longer than that.
  - LASR 4y ago
    Same here. I get MDM profile updates from IT on my work machine. One time they auto-installed a cloud backup service and sent out a company-wide email after they already did it. Something like: “Now nobody has to deal with lost data. You’re welcome!” Huge backlash from employees on that move. But I get both perspectives. These are work machines, and a mundane accident with the equipment shouldn’t incur significant losses to the business. But apart from the potential loss of personal privacy, it feels wrong. Especially so, when you’re looking for other jobs.
- kornhole 4y ago
  I think you are joking to bait us. At least use a VM running a VPN within it. It won't protect you from screen captures or keyloggers your employer put on your machine, but it will segregate files and network activity.
cfn 4y ago
I suppose that sending it during business hours and, who knows, maybe the final offer would be in the PDF and the poor guy couldn't wait to open it. The rest is history.
turtlebits 4y ago
If you're looking for work, you have to interview during the day, which you're probably in office (things are very different now). I know I'm guilty of having my personal emailed signed into my work computer (albeit with a separate browser). I've also done virtual interviews in the office meeting/phone room.
- bornfreddy 4y ago
  You've done interviews in the office of your (then) current employer??? Gutsy. I wouldn't dream of using employer's equipment, time or space while negotiating for a new employment.
the_af 4y ago
I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.
- kibibyte 4y ago
  https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+document https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.
  - planede 4y ago
    Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer. While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications. If the vulnerability (which I assume was RCE) was in a web browser, then it's a major bug.
    - kibibyte 4y ago
      As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).
      - planede 4y ago

by abirch 4y ago

kuboble 4y ago

It might be hard to believe that the particular person in a particular company did that, but given a lot of attempts, dedication and lucky / unlucky circumstances eventually somewhere someone will trust a malicious person and will get socially engineered into opening a pdf on a working computer.

godot 4y ago
Also wonder if the PDF exploit works for only local/native PDF readers (e.g. Adobe Readers) or also web-based. If someone occasionally checks their personal email from a work laptop, chances are they'd only use the Gmail preview to open the PDF. It seems like most engineers wouldn't get all the way to downloading a job offer PDF to their work laptop and opening it up there.

CrispinS 4y ago

I can't believe a software developer is using an operating system/pdf viewer that isn't patched for security vulnerabilities as major as an RCE. Unless this was a zero day, but I would have assumed the article would mention that fact ..

pcthrowaway 4y ago
I really wish we had details here too, but someone made a good point: "Hey, you need a PDF viewer with scripts enabled for the digital signing.. can you install Adobe XXX?" would be a good line to get the mark to use a less-than-secure PDF viewer. But also, since it was the North Korea hacking group, I'm not ruling out a 0-day... hopefully more details will come at some point.

da39a3ee 4y ago

Huh? I've used my company laptops for my personal life for the last 15 years. Why would I want to carry two laptops everywhere? I travel. I barely remember what a personal laptop is.

jazzyjackson 4y ago
lol do you at least dual boot? have a separate user account? I guess its fine as long as your computer doesn't have the credentials to the company slush fund. Friend of mine I traveled with carried 3 macbooks with her: school issued, work issued, and personal. They had different software licenses tied to the machine, whadyagonnado?
RajT88 4y ago
I travel with a HP Spectre x360 for personal stuff. It is barely a weight or bulk addition compared to my work machine. When I was on the road all the time I also had separate phones to ensure I never got stuck with a dead phone.
logifail 4y ago
> I've used my company laptops for my personal life for the last 15 years. Counterpoint: I've been completely and utterly allergic to opening anything personal from any company system for longer than that.
- LASR 4y ago
  Same here. I get MDM profile updates from IT on my work machine. One time they auto-installed a cloud backup service and sent out a company-wide email after they already did it. Something like: “Now nobody has to deal with lost data. You’re welcome!” Huge backlash from employees on that move. But I get both perspectives. These are work machines, and a mundane accident with the equipment shouldn’t incur significant losses to the business. But apart from the potential loss of personal privacy, it feels wrong. Especially so, when you’re looking for other jobs.
kornhole 4y ago
I think you are joking to bait us. At least use a VM running a VPN within it. It won't protect you from screen captures or keyloggers your employer put on your machine, but it will segregate files and network activity.

cfn 4y ago

I suppose that sending it during business hours and, who knows, maybe the final offer would be in the PDF and the poor guy couldn't wait to open it. The rest is history.

turtlebits 4y ago

If you're looking for work, you have to interview during the day, which you're probably in office (things are very different now). I know I'm guilty of having my personal emailed signed into my work computer (albeit with a separate browser). I've also done virtual interviews in the office meeting/phone room.

bornfreddy 4y ago
You've done interviews in the office of your (then) current employer??? Gutsy. I wouldn't dream of using employer's equipment, time or space while negotiating for a new employment.

the_af 4y ago

I open all sorts of PDFs, all the time, regardless of which computer I'm using. Is PDF as an attack vector such a widespread threat? I never payed much attention to them, assuming it's a document format that is relatively harmless even if it can include javascript. This is an honest question, by the way.

kibibyte 4y ago
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+document https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PDF+documen... PDFs are "harmless" on their own, but they are user-generated documents that conform to a complex specification. Viewing them requires software that parses them. These parsers are often written in unsafe low level languages. The (in)security of unsafe parsers reading user-generated input is a tale as old as time itself.
- planede 4y ago
  Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer. While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications. If the vulnerability (which I assume was RCE) was in a web browser, then it's a major bug.
  - kibibyte 4y ago
    As I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).
    - planede 4y ago