Foxit Reader - disable JavaScript / Safely read PDF

Question

Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read. As some sort of simple check I tried to open a PDF with fill-in forms and see what happens when I try to fill-in some of the fields and check some checkboxes. Everytime I checked a checkbox, a window opened, saying that JS is disabled and was used for some features in the document. It then gives me the possibilities to add the file to a privileged location or to enable JS again. However, if I just click "Cancel" or simply close this window, the checkbox remains checked and I can simply save the changes.

Now this makes me wonder if disabling JS is any good against potential malware in a PDF and if I should use a different reader or an entirely different solution.

So my question(s) would be: Based on this experience, is disabling JS in Foxit doing any good and what would be other good solutions for opening PDF files safely? I read about dedicated virtual machines or using Firefox with disabled JS. Would these be secure? The first one seems very unconvenient, since I use my laptop mainly for university and being able to open textbooks comfortably would be good. Then again, keeping my passwords, financial account etc. safe is a priority over convenience.

Answer 1

I don't think PDFs are as secure as user123. In the last years many attacks emerged. Some aim at the reader software others at the functionality of PDF itself.

Here is a blog entry about the topic: https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-behind-attacks/

One attack vector ist the execution of JavaScript. The PDF can download other files or post data to servers. So as long as your PDFs don't realy need JavaScript, you should disable it.

You should also disable the use of URLs to prevent the PDF to send information to servers. There has been PDFs, that extract your Windows credentials and post it to an malicious server.

That should be secure enough, if you only open files from trusted servers.

To be as secure as possible, you could run a VM with Linux and an open source PDF reader of your choice. Turn of the network access of that VM. You can share the PDFs through a shared folder with the host OS. You should not open the files on the host OS. This way a malicious PDF can not steal information and send it directly to a server. To infect your system, a chain of exploits would be needed to execute code, break out of the VM and execute Code on the host. It is not impossible but quite hard and depends on many unknown variables such as the uses linux, the reader, the VM technology and the host OS.

Answer 2

I studied this question a bit. I can say there is no way for a PDF to run malware by itself. The PDF is just bytes in a certain format. There is a very few amount of security risks if not none in the applications used to open PDFs. I would not use Firefox but Adobe to open PDF files. Firefox simply didn't implement the whole PDF specification. I use Firefox because it is open source but not for PDFs (unless you are on Linux).

If it was that easy to just run some JavaScript in a browser and put some malware in the computer, every website you visit would be a security risk. I think you can say that PDFs are secure.

Where it becomes a security risk is the icon. We are so used to the icons that we see that you will often launch a PDF without looking at the extension or info about the file. If the file is an executable, nothing prevents someone from specifying a PDF icon to an executable and mimick a PDF. This is how I would do it myself. So I would simply tcheck the PDF before opening it.

That is to say you should trust people enough to be sure there is no malware in a teacher's PDF and in downloadable books. Especially, if you use these books on a foxit reader which is hard to hack.

When you launch software on Windows or Linux, the OS tcheks the extension of the file and uses the default app this extension is associated to. It then puts the file path onto the stack of the new process which the app uses to parse the file. Unless there is a problem in the app used to launch the PDF or the PDF is an exe with a fake icon, I doubt it can do any harm.

I'm not saying it isn't a security risk to download stuff on Internet. But I think among the most secure files are the PDFs especially if they come from trusted sources like a teacher. I would not call a classmate a trusted source though.

If you want to be sure. You can always open documents on the cloud which is very secure because it is limited by the Internet browser which are very secure today.