Something I was wondering about after reading Didier Stevens Labs 2008 post: There are endless ways described how to put potential malicious content into a pdf file, while making it impossible for mask-based scanners to detect the content. If a pdf reader tries to parse such a compressed string it could happen that there is a zip-bomb included, or other malware. Therefore I was wondering if there is already a way to filter the potential malicious compressed parts out without removing the essential parts.
Moreover, other safety measures may include to:
- Use a less widely used and lighter PDF reader when Adobe Acrobat specific functionalities are not needed (DRM encrypted file, advanced forms, etc.),
- Disable the browser's builtin PDF reader and prefer using a standalone reader software,
- Moreover, on Windows environments, additional tools such as Microsoft EMET has shown to be effective against several buffer overflows affecting Adobe Acrobat Reader.
So, final word: do not trust PDF files to be safe...
"Safe" in Information Security means "the level of risk associated with this activity is one I am prepared to accept". There are risks in opening any potentially malicious file; and as with any risk, you either treat it, terminate it, tolerate it, or transfer it.
With PDF files, most people do a mixture of terminate and tolerate, by which I mean they try to avoid opening PDF files from dodgy sources, but otherwise they tolerate the risk and open the files because they need to work with documents in a well supported format.