Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

github.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#41

Post by heartbeats »

necovek wrote: post #21
userbinator wrote: post #4

Earlier quoted context omitted.

It's definitely brute force, in that it's the equivalent of printing a document onto paper and then scanning it back in. This "flattening" is highly effective at sanitising, but also removes all the semantic content in the process; the output should be several times larger than the input (and if it isn't, then it's an indication that something very suspicious was in the input....)

Indeed, I was hoping for something smarter, that would remove only the "risky" bits of PDF, but keep the overall structure (and size).

What about converting PDF to PostScript and back? It should keep most of the semantic information while removing the exploits.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#42

Post by heartbeats »

ris wrote: post #40

It's nice that PDF security is getting a bit more attention, but there are a number of things that this approach will trash, for instance, I don't have high hopes for the accessibility of the resulting PDF. (edit: and needless to say, any software in your pipeline which does full interpretation of an untrusted file will itself become the target for attacks, so this is only a useful tool if it is run in an extremely r…

Couldn't you just use a whitelist for the features?

If the reader can open a PDF/A-1 file and ignore the bad parts, can't it open a PDF file as PDF/A-1 and remove the bad parts, before saving it again?

Then you could use the "re-rendering" technique to extract images:

1. Create a stripped PDF/A-1 file from the original PDF.

2. In a VM, render the two PDF files to two high-resolution image sets.

3. Use some CV algorithm to find the differences. For example, gaussian blur, subtract, threshold, find islands.

4. Use this to come up with areas which use complicated PDF features and/or images. Say this returns that there is an image on page 9 in the rectangle ((17, 338), (400, 300)).

5. Crop out page 9 in rectangle ((17, 338), (400, 300)) from the original PDF. Use some CV algorithm to detect the DPI and whether it's best to encode as JPEG or PNG. Encode it and add to list of images.

6. Add sanitized images back from list, mark PDF/A-1 file with images as PDF/A-2.

Of course, you could do this for links or whatever as well. Spit out a list of rectangles and link targets in the PDF, and then put them back in.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#44

Post by gpvos »

masklinn wrote: post #33
johnlorentzson wrote: post #31

This kind of makes me wonder why PDFs can even act maliciously in the first place. Why does it have the ability to do these things?

PDF derives from PostScript which is a full-blown programming language so it's an "original sin" either way. Then over time Adobe added a number of interactive (forms), multimedia and rich media (embedded JS) features, leading to even more vectors.

The page description language part of PDF is based on Postscript, but explicitly simplified to be non-Turing-complete and safe (if implemented sanely). The later additions are the main culprit I think.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#45

Post by ris »

heartbeats wrote: post #42
ris wrote: post #40

It's nice that PDF security is getting a bit more attention, but there are a number of things that this approach will trash, for instance, I don't have high hopes for the accessibility of the resulting PDF. (edit: and needless to say, any software in your pipeline which does full interpretation of an untrusted file will itself become the target for attacks, so this is only a useful tool if it is run in an extremely r…

Couldn't you just use a whitelist for the features? If the reader can open a PDF/A-1 file and ignore the bad parts, can't it open a PDF file as PDF/A-1 and remove the bad parts, before saving it again? Then you could use the "re-rendering" technique to extract images: 1. Create a stripped PDF/A-1 file from the original PDF. 2. In a VM, render the two PDF files to two high-resolution image sets. 3. Use some CV algorit…

There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#46

Post by jrowley »

ris wrote: post #45
heartbeats wrote: post #42

Earlier quoted context omitted.

Couldn't you just use a whitelist for the features? If the reader can open a PDF/A-1 file and ignore the bad parts, can't it open a PDF file as PDF/A-1 and remove the bad parts, before saving it again? Then you could use the "re-rendering" technique to extract images: 1. Create a stripped PDF/A-1 file from the original PDF. 2. In a VM, render the two PDF files to two high-resolution image sets. 3. Use some CV algorit…

There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.

The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific.

Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#47

Post by _8j50 »

seanhunter wrote: post #19
_8j50 wrote: post #16

Very nice but fyi: most malicious pdf just contains links to something else,usually shortlinks. Social engineering is hard to mitigate.

If I understand this correctly, a link wouldn't survive this as the pdf is turned into images and then those images back into a pdf. So it's essentially like a scan of very high quality. What you would end up with is an image that looks like a link but would not be clickable.

Doesn't matter if it is not clickable. There are existing phishing campaigns that use jpeg attachments asking the user to copy paste it (or just let the user try to copy and fail and manually type it out). Perhaps adding a text warning users to not open any links on the document will easily prevent that?

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#48

Post by heartbeats »

ris wrote: post #45
heartbeats wrote: post #42

Earlier quoted context omitted.

Couldn't you just use a whitelist for the features? If the reader can open a PDF/A-1 file and ignore the bad parts, can't it open a PDF file as PDF/A-1 and remove the bad parts, before saving it again? Then you could use the "re-rendering" technique to extract images: 1. Create a stripped PDF/A-1 file from the original PDF. 2. In a VM, render the two PDF files to two high-resolution image sets. 3. Use some CV algorit…

There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.

I am not sure whether bookmarks or signed sections are "extremely useful". This has some minor advantages, but it's also a large attack surface. At least in this way, you keep most useful features.

As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely?

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#49

Post by _8j50 »

This wouldn't work for businesses because PDF forms and legitimate links and even embedded objects. I think this is a great idea if you have users preview the image version before opening the whole thing maybe? Even as an individual, I have had to fill out pdf forms for various usgov applications, job applications,etc...

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#50

Post by ris »

heartbeats wrote: post #48
ris wrote: post #45

Earlier quoted context omitted.

There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.

I am not sure whether bookmarks or signed sections are "extremely useful". This has some minor advantages, but it's also a large attack surface. At least in this way, you keep most useful features. As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely?

> I am not sure whether bookmarks or signed sections are "extremely useful".

Well, they are. You try using a thousand page manual that doesn't have a section outline, or try sending around PDFs whose authenticity is legally important (to people who aren't capable of using gpg). This is only scratching the surface - there are many features which are important to people with e.g. accessibility needs which aren't directly visible.

> This has some minor advantages, but it's also a large attack surface.

These are not a large attack surface. TIFF, JavaScript/PostScript, 3D content and video (yes - PDFs can contain video!) are a "large attack surface".

> As jrowley said, if you trust the reader to sanitize it safely, why not trust it to open normal PDF files safely?

Well, firstly, I emphasised how "PDF readers are supposed to automatically 'turn off' non-PDF/A features", so I already acknowledge the caveat. And as far as "trusting them" goes, disabling the decoding of certain features involves very few LOC. Completely implementing the whole specification for the more exotic PDF features is an incomparably huge number of LOC, which are proportionately more likely to have flaws.

Post reply on HN