4

I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from uploading. The problem is that in case it detects a pdf file that has not seen it again (meaning its SHA) it allows to be upload it and then sends it for analysis in a dedicated sandboxed cloud environment. But since it allows the file I am trying to "block" PDF files containing Javascript or Embedded files using a code snippet running on the web server. Is there something else I should consider to block besides this?

  • 3
    Sounds simple, but things that aren’t PDFs, maybe? – nbering Oct 30 '18 at 11:57
  • Well, we do not accept anything but PDF. We reject other type files again using a code snippet. So you think we block macros by rejecting PDFs containing Javascript? – fargo01 Oct 30 '18 at 12:18
  • You could also make PDFs not publicly available till the analysis is over in order to prevent potential xss type of attacks in case some obfuscated js bypasses your code snippet. – game0ver Oct 30 '18 at 12:20
  • The PDFs will not be publicly available fortunately! Thank you for your reply! – fargo01 Oct 30 '18 at 13:17
6

Run them all through a converter into PDF/A format.

It forbids any sort of active content.

If they won't convert, trash them.

IDS/IPS with Anti-Malware license

Scanning is a losing battle. No matter what your scanner knows to look for, there will always be something new that it doesn't know to look for.

dedicated sandboxed cloud environment

That's useful for generic malware, but not useful for targeted malware that will only execute it's payload under conditions that only exist at it's target.

If you want to make sure the file won't do anything Evil when opened, make sure it doesn't contain anything executable. You do this by running the conversion to non-executable PDF/A yourself. This creates a new, clean PDF file that by definition isn't infected because you created it.

  • Oh this is interesting! I haven't thought about using PDF/A for this purpose before. I suppose I should fuzz some parsers in PDF/A mode and see how that works out... – forest Oct 31 '18 at 3:09
  • Thank you very much .@PushfPopf so the web server should "run" a PDF/A converter? Is there a tool or piece of code you would suggest? – fargo01 Oct 31 '18 at 15:55
  • 1
    I'd be very surprised if the conversion process was exploitable (aside from making it fail) however if you're concerned, there's no reason you couldn't run it in a vm. – PushfPopf Nov 1 '18 at 12:46
  • 1
    @fargo01 I really have no idea. I use GhostScript in a high volume 24x7 production environment and have never had any issues with it. I don't know anything about pdfium. – PushfPopf Nov 1 '18 at 12:50
  • 1
    @fargo01 The exploits are typically in the viewer app or GDI on the user's desktop. I'm running it on a headless server which has neither. – PushfPopf Nov 1 '18 at 12:52
3

It is almost impossible to prevent upload of malicious PDF files since a script needs to be able to detect the malicious content. Someone could zip and encrypt a virus which can be saved in a PDF which would not be detectable by any analysis without the decryption key. An anti virus/trojan programme suite (eg Malwarebytes) should be run on the server to quarantine (including delete) any infected files found so they cannot do any harm after upload. You could block all uploads to be sure malicious content does not get through.

Malicious PDF files are generally used to target vulnerabilities in a PDF Viewer (or other popular file opening programs) so would be good to ensure no PDF Viewers, or other client only applications such as Adobe Applications , Microsoft Office Application (which are often targeted by zero day exploits) are installed on the upload server. All browsers on the server should be locked down as far as possible (PDF files can be viewed in some browsers if configured to do so possibly triggering a booby trapped payload) and ensure no JavaScript programs such as NodeJS are in use.

  • I forgot to mention that the web server will also have Mawalrebytes and Windows Defender. Thank you for your reply! – fargo01 Oct 30 '18 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.