5

I know that PDFs can contain embedded images and Javascript.

Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that image (thus revealing the user's IP address)? (Like a 1x1 image / web bug.) Or, can the Javascript trigger a GET request to a server the PDF author controls, a fetch of a network resource, or a DNS lookup that would reveal anything about the identity of the user opening the PDF document? Or maybe embedded Flash?

I can imagine this might exist if the user clicks through a warning, but can a PDF do this without triggering a warning to the user?

Improve this question
1

1 Answer 1

Reset to default
8

Can a PDF contain something that tracks you?

If you mean in the PDF file itself, and part of the PDF standard, and which does not require the user to click on something (like a link annotation), it would just be javascript. Which means in general, especially if javascript interpretation is off, then no a PDF can't track you.

Generally PDF DRM/tracking is done as combination of a PDF with proprietary data in it, combined with specific PDF reader to interpret that data.

can it contain a remote image that, when the PDF is opened, will fetch that image

No, PDF does not support external images in the page content. You can have references to external resources, but these have nothing to do with displaying the PDF, and in general a PDF reader would not fetch that remote resource automatically, though a particular PDF reader application could do that.

can the Javascript trigger a GET request to a server the PDF author controls, a fetch of a network resource, or a DNS lookup that would reveal anything about the identity of the user opening the PDF document?

The PDF itself would not do this, but a PDF reader with javascript enabled, might end up doing this automatically if such javascript existed in the PDF.

Or maybe embedded Flash? Same as above, but I believe only Adobe products would do this. Would be a much smaller set of PDF readers that would have built-in flash support.

I can imagine this might exist if the user clicks through a warning, but can a PDF do this without triggering a warning to the user?

The PDF file itself, no, but a PDF reader could certainly process the javascript in a PDF and may do this without warning the user. Would depend on how the PDF reader was written. PDF format supports javascript triggers on document opening and page opening actions for instance, so if a PDF reader was configured with javascript enabled, then potentially the PDF could trigger such a network request automatically without the user knowing.

So in the end it is possible, but completely depends on the application opening the PDF, what it's settings are, and what javascript API calls it supports.

Improve this answer
1
  • 1
    Thank you! One follow-up: you mention "a PDF reader with javascript enabled [might do this]" - do you know whether many PDF readers have Javascript enabled and allow Javascript to make network requests automatically? I understand that it totally depends on the PDF reader; I would like to get a sense of what the most popular/wide-deployed PDF readers do, as that will determine the exposure for end users today.
    – D.W.
    May 14, 2020 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .