Malicious PDF file upload

Question

I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from uploading. The problem is that in case it detects a pdf file that has not seen it again (meaning its SHA) it allows to be upload it and then sends it for analysis in a dedicated sandboxed cloud environment. But since it allows the file I am trying to "block" PDF files containing Javascript or Embedded files using a code snippet running on the web server. Is there something else I should consider to block besides this?

Answer 1

Run them all through a converter into PDF/A format.

It forbids any sort of active content.

If they won't convert, trash them.

IDS/IPS with Anti-Malware license

Scanning is a losing battle. No matter what your scanner knows to look for, there will always be something new that it doesn't know to look for.

dedicated sandboxed cloud environment

That's useful for generic malware, but not useful for targeted malware that will only execute it's payload under conditions that only exist at it's target.

If you want to make sure the file won't do anything Evil when opened, make sure it doesn't contain anything executable. You do this by running the conversion to non-executable PDF/A yourself. This creates a new, clean PDF file that by definition isn't infected because you created it.

Answer 2

It is almost impossible to prevent upload of malicious PDF files since a script needs to be able to detect the malicious content. Someone could zip and encrypt a virus which can be saved in a PDF which would not be detectable by any analysis without the decryption key. An anti virus/trojan programme suite (eg Malwarebytes) should be run on the server to quarantine (including delete) any infected files found so they cannot do any harm after upload. You could block all uploads to be sure malicious content does not get through.

Malicious PDF files are generally used to target vulnerabilities in a PDF Viewer (or other popular file opening programs) so would be good to ensure no PDF Viewers, or other client only applications such as Adobe Applications , Microsoft Office Application (which are often targeted by zero day exploits) are installed on the upload server. All browsers on the server should be locked down as far as possible (PDF files can be viewed in some browsers if configured to do so possibly triggering a booby trapped payload) and ensure no JavaScript programs such as NodeJS are in use.