New Method Could Hide Malware In PDFs, No Further Exploits Needed 234
Trailrunner7 writes "A security researcher has managed to create a proof-of-concept PDF file that executes an embedded executable without exploiting any other security vulnerabilities. The PDF hack, when combined with clever social engineering techniques, could potentially allow code execution attacks if a user simply opens a rigged PDF file. With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this."
Sad (Score:2, Troll)
Re:Sad (Score:5, Insightful)
But for once Adobe is actually more secure than the better alternative Foxit. Adobe PDF Reader at least warns and asks your permission to run the file, but Fox It does neither one but just happily runs it. That fact made me uninstall Foxit for now at least.
Re:Sad (Score:5, Informative)
That fact made me uninstall Foxit for now at least.
You shouldn't have to wait long.
http://forums.foxitsoftware.com/showthread.php?t=18029 [foxitsoftware.com]
this issue has been confirmed, and a maintenance version will be released within this week.
Re: (Score:3, Informative)
Ummm... Adobe already warns you about it. So less than zero days.
Re:Sad (Score:4, Insightful)
Of course, the average user is known to thoroughly read the warnings and definitely will not click "OK, just get this thing out of my face" within half a second after the dialog box has finished rendering.
Re:Sad (Score:5, Informative)
From the author:
" My PoC PDF requires some changes for Foxit Reader, because ultimately, the executable doesn't run. But that's probably due to some variation in the PDF language supported by Foxit Reader."
Not really a proof of concept since the proof doesn't actually run the code currently. Not that it couldn't but there's no proof that Foxit is less secure since it doesn't actually run the code.
Re:Sad (Score:4, Informative)
http://blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/ [didierstevens.com]
He got it working in Foxit pretty quickly after the first post about the PoC.
Re:Sad (Score:5, Informative)
Also the first comment there says how you can hex edit the .exe to disable this "feature".
If you can live without the /Launch functionality (I can!), edit the executable:
- search for “^@Launch^@” (^@ == null byte, file offset 7040965 in 3.13.1030) in Foxit Reader.exe,
- change it to e.g. “L!unch” (no quotes),
- save AS BINARY,
done.
Comment by Thomas — Wednesday 31 March 2010 @ 12:20
Re: (Score:2)
Re: (Score:2)
Huh, where I work, it stands for "products of conception". I was a little confused when reading the article.
Re: (Score:3, Funny)
...I was thinking PoC meant Piece of Crap which I thought was redundant when referring to a PDF.
In my experience, the proper industry acronym is BFPoC, for Big Fat Piece of Crap, a term allegedly coined by one Artemus Clyde Frog.
Re: (Score:3, Insightful)
PDF is (or was) a good format and standard; it lets you define documents so that they look the same on any platform, and can be printed on any printer and look identical.
The only problem with it is that it was perfected for this purpose long ago, so Adobe kept adding more and more crap to it.
This is one reason open-source is generally better: when an open-source project is done, the developers leave it that way (unless any bugs are found), and go find something else productive to work on. They don't try to
Re:Sad (Score:4, Funny)
This is one reason open-source is generally better: when an open-source project is done, the developers leave it that way (unless any bugs are found), and go find something else productive to work on.
One word: Emacs.
Re: (Score:3, Interesting)
Re:Sad (Score:4, Informative)
Ever since Adobe perfected the basic PDF functionality and needed to keep adding features. Whether they are frills or not, whether they depart from the purpose of PDF or not, Adobe has to do this to justify its marketing. They want their customers to have reasons to keep wanting the latest version. Feature creep, in other words.
With Foxit Reader (Score:5, Interesting)
There's no warning at all. It just runs. [zdnet.com]
Re: (Score:2)
Tried to switch to evince on Windows machines. However, the most recent version doesn't let you print files. That obviously is a problem.
Maybe sometime in the next year or two the developers will post a fix. The last time I looked a few months ago there wasn't a fix, and it looked like the problem had been around for a while. Note to FOSS devs - "fixed in CVS" isn't a fix if there isn't a simple to use free build platform on the target OS.
further proof D. Knuth was right (Score:5, Insightful)
Notice you never hear about exploits-of-the-week like this for LaTeX !
Re: (Score:2)
What dynamic content? This has nothing to do with JavaScript.
With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this ( I don’t use JavaScript in my PoC PDF ), and patching Adobe Reader isn’t possible (I’m not exploiting a vulnerability, just being creative with the PDF language specs).
Re: (Score:2)
What dynamic content? This has nothing to do with JavaScript.
Dynamic content != JavaScript.
Dynamic content is a generic name for all manner of executable things, including not only PDFs and JavaScript, but also LaTeX, ActiveX, VBScript, etc. JavaScript is simply one of many different implementations of dynamic content.
In this case it's a "/Launch" command in the PDF syntax that's being exploited.
Re: (Score:2)
PostScript, the basis of PDF, is a full, turing-complete programming language! This has nothing to do with JavaScript!
Re: (Score:2)
You've heard of PostScript, right?
Re:further proof D. Knuth was right (Score:5, Insightful)
I can't decide if you're trying to be ironic, but there are no 'vulnerabilities' in LaTeX because the ability to interact with files and run arbitrary programs are part of the language. The reason LaTeX isn't often exploited is that it is very rare to run LaTeX programs from untrusted sources; you distribute the output from the program, not the program itself.
On a slightly different topic, is there a competition going on in Adobe to see if the Flash or Acrobat teams can collect the most security advisories?
Management breakdown at Adobe? (Score:3, Interesting)
There seems to be a social breakdown at Adobe. There are a lot of issues that aren't being managed well. For example, we bought Adobe Creative Suite 3 (before CS4 was released). The CD had an old version. To get the newest version it was necessary to download a 320 Megabyte file, on the same week that Adobe shipped the CD.
The new Acrobat takes longer to make
Re: (Score:3, Informative)
PDF is the evolved form of PostScript - http://en.wikipedia.org/wiki/PostScript [wikipedia.org] and at the time PS came out, it wasn't that bad of an idea, especially since it enabled us to actually print IMAGES.
Unfortunately, feature creep set in and instead of creating a language actually meant for publishing and sharing documents, Adobe just reimplemented PS in PDF and glossed over the fact that they were using an elephant gun to shoot mosquito. This is coming back around to bite them in their butt. But the actual origi
Re: (Score:2)
Re: (Score:2)
Actually while I was a CS major one of our labs was half NeXTSTEP (http://en.wikipedia.org/wiki/NeXTSTEP) and was aware of graduate students who pranked each other on the lab computers using the fact that the computers used postscript as a display engine.
Re:further proof D. Knuth was right (Score:4, Interesting)
PDF has some superficial syntactic similarities to PostScript. Beyond that, it is not at all like PostScript. The reason the content stream language of PDF is PostScript-like is because it made it easy to print PDF by simply blowing the content stream out as PostScript, accompanied by the appropriate ProcSets. Such usage is deprecated these days -- ProcSets are no longer required to be declared, and modern PDFs can't be printed by blowing the content stream directly to the printer any more.
Even in the areas where PDF looks like PostScript, it's fundamentally different. There is no operand stack. There are no control flow operators. If you start trying to create a PDF under the impression that it's just like PostScript, you'll fail miserably.
Re: (Score:2, Insightful)
Why don't you compile the following document with "tex --shell-escape" as root
\write18{rm -fR /}
Re: (Score:2)
Who the hell thought it was a good idea to have dynamic content in a document description language?
Notice you never hear about exploits-of-the-week like this for LaTeX !
That's a good question. Someone should be asking the people who put Javascript in Netscape the same thing! I mean, there's absolutely no use cases for having dynamic documents!
"This cannot be patched" (Score:5, Insightful)
"This cannot be patch because it isn't a vulnerability." Uhh yes it can, and sure it is. There are millions of bugs that were entirely by design and the designs adapted to eliminate them. I will grant that they might have to break the PDF spec' to fix it but frankly it is the right thing to do for everyone concerned.
Re: (Score:3, Insightful)
Exactly. To execute code, at some point, the reader is branching into data created or loaded by the pdf. When is that ever a good idea? If it's part of the PDF spec then it's a pretty good part to break compatibility with.
Re: (Score:3, Insightful)
One man's feature is another man's defect.
In the case of security "features", one man's feature is EVERYONE's defect.