3 ms·
Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default
by planede 4y ago
Most people view pdfs now in web browsers built-in viewers. Especially if the job offer comes from a linkedin message, I would imagine most people would default to the browser viewer.
While browsers are sure not without security vulnerabilities, I sure trust the PDF viewer within to be way more sandboxed than most standalone desktop PDF viewer applications.
If the vulnerability (which I assume was RCE) was in a web browser, then it's a major bug.
- kibibyte 4y agoAs I mentioned in another comment (and I think others have mentioned this as well), browser PDF viewers implement a subset of PDF features, and notably they won't support things like forms (I think?) or signatures. So I can imagine that attacker tricked the user into opening the PDF with separate software by saying something along the lines of "you need Adobe Reader to sign this document" (and I don't think DocuSign is ubiquitous enough that users will second guess that).
- planede 4y agoI think both Firefox and Chrome support forms now, although I know that there are other interactive features that they don't support. But yeah, I can see the attacker convincing the victim to use Adobe regardless.