Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

github.com

Post reply on HN
Print view View original

11–20 of 60 posts

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#11

Post by mettamage »

saagarjha wrote: post #9
mettamage wrote: post #6

Earlier quoted context omitted.

Well is it safe? Don't know. Safer: definitely. Given that the collective amount of PDF attacks is some number, now this particular PDF needs to attack PDF and the webviewer. Assuming that 1% of all PDFs do that, I'd say it's 100 times safer than not using a webviewer. If you still think that 1% of all potential PDF attacks is too unsafe, then that's a different discussion. If you think my 1% is off, then that's a di…

Well, PDF attacks need to attack the viewer you're using too…

True, but in most cases this is assumed to be a popular PDF reader. If it is specifically targeting a webviewer, I agree. But that still means that there is some JS PDF parser in between, though that provides very little in terms of security, I doubt that such a parser will check for malicious input.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#14

Post by heeen2 »

mettamage wrote: post #11
saagarjha wrote: post #9

Earlier quoted context omitted.

Well, PDF attacks need to attack the viewer you're using too…

True, but in most cases this is assumed to be a popular PDF reader. If it is specifically targeting a webviewer, I agree. But that still means that there is some JS PDF parser in between, though that provides very little in terms of security, I doubt that such a parser will check for malicious input.

Afaik chromium uses the same pdf renderer as foxit (pdfium)

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#17

Post by seanhunter »

TekMol wrote: post #13

Download Dangerzone So instead of opening a PDF from the internet on my machine, I now run code from the internet on my machine?

There's a big difference between opening a random PDF and downloading code which you can view yourself on github, no? Or does your computer (from cpu microcode up) only run code which you have personally written and is not "from the internet"?

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#18

Post by intherdfield »

A4ET8a8uTh0 wrote: post #5
namanyayg wrote: post #3

Useful tool -- it's trivial to make a RAT bypass chat/email .doc/.PDF attachments. I don't open any files on my PC from people I don't personally know -- use webviewers.

Odd question. Why would a webviewer be safer in this case? edit: Thank you for both answers. I thought it had to do with sandbox rationale, but couldn't mentally get past the fact that sandbox could potentially be escaped too. Eh, I think it is time for sleep.

On macOS, the PDF reader Preview.app runs sandboxed by default.

The Preview.app sandbox is not quite as secure as what is used by browsers such as Firefox or Chrome on macOS for web content, so there is probably still a benefit to viewing PDFs in the browser, depending on whether the browser or PDF viewer is more hardened against these attacks.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#19

Post by seanhunter »

_8j50 wrote: post #16

Very nice but fyi: most malicious pdf just contains links to something else,usually shortlinks. Social engineering is hard to mitigate.

If I understand this correctly, a link wouldn't survive this as the pdf is turned into images and then those images back into a pdf. So it's essentially like a scan of very high quality.

What you would end up with is an image that looks like a link but would not be clickable.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#20

Post by leskat »

seanhunter wrote: post #19
_8j50 wrote: post #16

Very nice but fyi: most malicious pdf just contains links to something else,usually shortlinks. Social engineering is hard to mitigate.

If I understand this correctly, a link wouldn't survive this as the pdf is turned into images and then those images back into a pdf. So it's essentially like a scan of very high quality. What you would end up with is an image that looks like a link but would not be clickable.

> Dangerzone can optionally OCR the safe PDFs it creates, so it will have a text layer again

I'm not completely sure, but wouldn't this parse links and make them accessible again, possibly even clickable?

Post reply on HN