[펌] Attacks on PDF Signatures: Certification Attacks (2021)

- Link

• https://pdf-insecurity.org/downloads/paper_reports_theses.html#attacks-on-pdf-signatures-certification-attacks-2021
• https://pdf-insecurity.org/download/pdf-certification/exploits.zip

 

So what is the problem?
We investigate the following question: How dangerous are permitted changes in certified documents?. To answer this question we systematically analyze the allowed modifications in certified documents and reveal two new vulnerabilities abusing flaws in the PDF specification: Evil Annotation Attack (EAA) and Sneaky Signature Attack (SSA). These vulnerabilities allow an attacker to change the visible content of a PDF document by displaying malicious content over the certified content. Nevertheless, the certification remains valid and the application shows no warnings.

How bad is it?
We evaluated 26 PDF applications and were able to break the security of certified documents in 24 of them. Additionally, we analyzed 26 applications to determine whether the permissions for adding annotations and signatures, as defined in the PDF specification, were implemented correctly. We show that for 11 of 26 applications, a permission mismatch exists.

The detailed results of our study can be found in the Evaluation and in our Paper (S&P'21).

Code Injection Attack on Adobe: Only certified documents may execute high privileged JavaScript code in Adobe products. For example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.

 

02_Contract_cert_p2_SSA_sig-field_added_high_priv_JS_added_manipulated.pdf

0.02MB

01_Contract_cert_p3_EAA_FreeText_AMOUNT_manipulated.pdf

1.34MB

01_Contract_cert_p3_EAA_annot_added_high_priv_JS_added_manipulated.pdf

0.02MB

01_Contract_cert_p2_SSA_v1_sig-field_added_signed_manipulated.pdf

1.40MB