Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

github.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#51

Post by bostik »

hurricanetc wrote: post #37
namanyayg wrote: post #3

Useful tool -- it's trivial to make a RAT bypass chat/email .doc/.PDF attachments. I don't open any files on my PC from people I don't personally know -- use webviewers.

FWIW... you probably shouldn’t even trust your contacts. People get phished all the time.

As far as phishing goes, few things are more effective than popping a medium sized law firm and sending form letters from their (legit) systems as a real person.

Click-through rate for a technically legitimate "you are party to a lawsuit" email must be sky high.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#52

Post by ris »

jrowley wrote: post #46
ris wrote: post #45

Earlier quoted context omitted.

There are myriad ways that PDFs could be re-written and re-rendered, but they would all be quite complicated and/or throw away a lot of extremely useful "meta" information (bookmarks, signed sections etc.) and almost certainly make files much bigger. The idea of the "appending" trick would be to mutate the original file as little as possible, but convince the reader to open it in a safer mode.

The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific. Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality.

> The small issue with the append trick is that is that it assumes the reader application will now respect the new format and not open insecure parts... which might not be fully implemented in all cases and is reader specific.

Yes, note my original emphasised use of the term "supposed to".

> Fully sanitizing the PDF yields better guarantees of security at the cost of lost functionality.

Indeed it's a tradeoff. But if you're willing to throw away the features which this extreme sanitization would trample across and have any ability to design PDF out of your system, you're probably better off not using PDF at all in favour of some straightforward image format.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#53

Post by layer8 »

ris wrote: post #40

It's nice that PDF security is getting a bit more attention, but there are a number of things that this approach will trash, for instance, I don't have high hopes for the accessibility of the resulting PDF. (edit: and needless to say, any software in your pipeline which does full interpretation of an untrusted file will itself become the target for attacks, so this is only a useful tool if it is run in an extremely r…

The trick of retroactively declaring a PDF as PDF/A by appending an incremental update won't work well for signed PDFs, because the PDF reader would recognize the PDF as having been modified since the signature, and when displaying the signed version of the PDF (i.e. removing all incremental updates after the signature) the PDF/A declaration will not be part of it and hence the PDF/A restrictions not be observed by the PDF reader. Put slightly differently: A PDF signature effectively freezes the non-PDF/A nature of a PDF.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#54

Post by ris »

layer8 wrote: post #53
ris wrote: post #40

It's nice that PDF security is getting a bit more attention, but there are a number of things that this approach will trash, for instance, I don't have high hopes for the accessibility of the resulting PDF. (edit: and needless to say, any software in your pipeline which does full interpretation of an untrusted file will itself become the target for attacks, so this is only a useful tool if it is run in an extremely r…

The trick of retroactively declaring a PDF as PDF/A by appending an incremental update won't work well for signed PDFs, because the PDF reader would recognize the PDF as having been modified since the signature, and when displaying the signed version of the PDF (i.e. removing all incremental updates after the signature) the PDF/A declaration will not be part of it and hence the PDF/A restrictions not be observed by t…

Yes - I think this is only true following https://www.pdfa.org/recently-identified-pdf-digital-signatu...

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#55

Post by layer8 »

ris wrote: post #54
layer8 wrote: post #53

Earlier quoted context omitted.

The trick of retroactively declaring a PDF as PDF/A by appending an incremental update won't work well for signed PDFs, because the PDF reader would recognize the PDF as having been modified since the signature, and when displaying the signed version of the PDF (i.e. removing all incremental updates after the signature) the PDF/A declaration will not be part of it and hence the PDF/A restrictions not be observed by t…

Yes - I think this is only true following https://www.pdfa.org/recently-identified-pdf-digital-signatu...

Those vulnerabilities really have nothing to do with the PDF/A question. PDF signature validators have to check for them regardless of PDF/A, and the issue I raised above is independent of those vulnerabilities.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#56

Post by pbhjpbhj »

mettamage wrote: post #11
saagarjha wrote: post #9

Earlier quoted context omitted.

Well, PDF attacks need to attack the viewer you're using too…

True, but in most cases this is assumed to be a popular PDF reader. If it is specifically targeting a webviewer, I agree. But that still means that there is some JS PDF parser in between, though that provides very little in terms of security, I doubt that such a parser will check for malicious input.

>a popular PDF reader

What's the most popular, Chrome browser I'd have thought?

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#57

Post by necovek »

heartbeats wrote: post #41
necovek wrote: post #21

Earlier quoted context omitted.

Indeed, I was hoping for something smarter, that would remove only the "risky" bits of PDF, but keep the overall structure (and size).

What about converting PDF to PostScript and back? It should keep most of the semantic information while removing the exploits.

Yeah, perhaps. The "gruntwork" would be to figure out if that is sufficient. Heck, taking your idea further, perhaps convert to something non-derivative like HP's PCL5 and back. Or SVG or...

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#58

Post by seanhunter »

leskat wrote: post #20
seanhunter wrote: post #19

Earlier quoted context omitted.

If I understand this correctly, a link wouldn't survive this as the pdf is turned into images and then those images back into a pdf. So it's essentially like a scan of very high quality. What you would end up with is an image that looks like a link but would not be clickable.

> Dangerzone can optionally OCR the safe PDFs it creates, so it will have a text layer again I'm not completely sure, but wouldn't this parse links and make them accessible again, possibly even clickable?

Given the security focus here I'd be somewhat surprised if they did this - links are one of the main threat vectors associated with pdfs.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#59

Post by Piskvorrr »

gpvos wrote: post #44
masklinn wrote: post #33

Earlier quoted context omitted.

PDF derives from PostScript which is a full-blown programming language so it's an "original sin" either way. Then over time Adobe added a number of interactive (forms), multimedia and rich media (embedded JS) features, leading to even more vectors.

The page description language part of PDF is based on Postscript, but explicitly simplified to be non-Turing-complete and safe (if implemented sanely). The later additions are the main culprit I think.

"if implemented sanely" - oh well. The original idea was nice.

Re: Dangerzone: Convert potentially dangerous PDFs, documents, or images to safe PDF

#60

Post by maxerickson »

johnlorentzson wrote: post #31

This kind of makes me wonder why PDFs can even act maliciously in the first place. Why does it have the ability to do these things?

Because computer, a benign feature of pdf can still lead to an exploit in a viewer.

Note the attempts at the link to sanitize image formats that don't have over the top complexity.

If your question is why an electronic document format has support for images and interactivity, I don't know what to tell you.

Post reply on HN