Questions tagged [pdf]

Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

PDF security analysis tool for non-experts

I occasionally come across PDFs from shady sources. Is there a tool that a non-expert can use, which can check them for common vulnerabilities? I have seen this question: Malicious PDF Analysis but I'...
user avatar
2 votes
1 answer
92 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
user avatar
  • 21
0 votes
3 answers
155 views

Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?

The answers to Can a PDF file contain a virus? show that clearly it can! Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
user avatar
  • 1,214
0 votes
1 answer
48 views

Personally identifiable information in a PDF bank statement?

I have got to upload a sample bank statement PDF online which is going to accessible to everyone. I have obviously edited out all account details, names, codes, transaction particulars and the ...
user avatar
0 votes
1 answer
81 views

What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?

I have edited a PDF file in Acrobat, which left some metadata and I am wondering: What metadata might be possible to discern from the end file if I were to send it to external parties? What actions ...
user avatar
  • 101
0 votes
2 answers
125 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content (flash, JS, etc.) to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients, and while the image formats ...
user avatar
0 votes
1 answer
87 views

Secure PDF Document Transmission for US State Government Official

I have been requested to send a copy of a past year tax return to a US state office. I have been in contact with a tax official by email to send this copy through various means. This state is a few ...
user avatar
0 votes
1 answer
111 views

Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)?

Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)? In my understanding is that most image files don't carry any security risk because all exploits were fixed, but ...
user avatar
0 votes
2 answers
108 views

HSM High Volume Keys

Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
user avatar
  • 101
1 vote
0 answers
215 views

A PDF ran GetAdaptersAddresses. Should I be concerned?

I received and opened a PDF that ran: GetTickCount IsDebuggerPresent SetWindowsHookExW Sleep GetAdaptersAddresses These are the 2 files it wrote: C:\Windows\ServiceProfiles\LocalService\AppData\...
user avatar
1 vote
1 answer
442 views

Strange virustotal tags on pdf file

I've received PDF at work, which I then ran through virustotal scan out of habit. It turned out to be clean, but at the same time some tags caught my attention, namely: checks-user-input detect-debug-...
user avatar
1 vote
2 answers
116 views

Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)

For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server ...
user avatar
16 votes
2 answers
6k views

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present ...
user avatar
  • 291
0 votes
0 answers
217 views

Get encrypted PDF password

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file. I used pdf2john.pl to get the password hash and I performed a brute force ...
user avatar
0 votes
1 answer
376 views

Where is the PDF encryption key stored

Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
user avatar
4 votes
3 answers
2k views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
user avatar
4 votes
2 answers
414 views

How to harden Adobe Acrobat and Acrobat Reader

I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both ...
user avatar
  • 373
1 vote
2 answers
1k views

What PDF file format alternative should I choose if I am looking for more security in my document files? [closed]

There are tons of exploits being created using the PDF file format for most PDF viewers out there every year. PDF files have lots of power and can utilize things such as JavaScript. This is really ...
user avatar
  • 127
0 votes
0 answers
899 views

John the ripper - "no password hashes loaded " for pdf

I'm trying to decrypt a pdf that I no longer have the password for. When I use JohnTheRipper, it can't seem to load any password hashes. Basically, this is what I run. └─$ perl pdf2john.pl /home/...
user avatar
0 votes
2 answers
289 views

Can converting a virus-infected webpage to PDF format still contain viruses [closed]

So I know that PDF files can contain viruses themselves if they are target specifically for that purpose. However, my question for here is this: If a webpage that has some malicious scripts or a virus ...
user avatar
0 votes
2 answers
635 views

Foxit Reader - disable JavaScript / Safely read PDF

Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read. As some sort of simple check I tried to open a PDF with ...
user avatar
0 votes
1 answer
312 views

Is converting malicious PDF to JPG then backwards via web services is good method to obtain safe PDF?

I've downloaded a book but by default its considered malicious by me. I thought of converting that PDF to JPG here: https://smallpdf.com/pl/pdf-do-jpg Then backwards: https://smallpdf.com/pl/jpg-to-...
user avatar
  • 3
0 votes
2 answers
491 views

Is it impossible to have a PDF file execute a command without abusing any exploits?

We are running a purple team which includes attempting to run a malicious PDF on the target system. The targeted user is well aware of the exercise so there is no concerns about an AV picking the ...
user avatar
  • 875
1 vote
0 answers
188 views

Is the most secure way of viewing an infected pdf file through a cloud pdf reader like xodo using a pdf uploaded to Google Drive?

Is the most secure way of viewing an infected pdf file through a cloud pdf reader like xodo using a pdf uploaded to Google Drive? I have a work laptop and I currently work for a small startup that had ...
user avatar
  • 11
2 votes
1 answer
3k views

Unable to get John the Ripper to crack PDF password

I am new to Kali Linux and JTR but am playing around trying to crack a PDF file. I set the PDF Password to test so it's a known password on my own file. For whatever reason JTR appears to finish ...
user avatar
2 votes
1 answer
237 views

How can a pdf file have two passwords?

I receive emails from my bank with password protected PDF files, and they provide two passwords - either xxxx or yyyy. How is this possible?
user avatar
  • 121
3 votes
3 answers
6k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
user avatar
5 votes
1 answer
819 views

Can a PDF embed a tracking image?

I know that PDFs can contain embedded images and Javascript. Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
user avatar
  • 98.3k
2 votes
1 answer
349 views

Why do PDFs contain password hashes?

Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
user avatar
0 votes
0 answers
45 views

John the Ripper [duplicate]

I've already cracked a PDF with pdf2john but it doesn't show the password. What could be the problem? (The password isn't blank.)
user avatar
0 votes
0 answers
755 views

Android 10 downloaded suspicious files without my permission

This is my first question on this forum so please let me know if I need to clarify anything. My Android 10 Pixel 2 just downloaded 2 files without my permission today, both named something to the ...
user avatar
15 votes
8 answers
2k views

Document security - how to find who's leaked a confidential document?

I am legally obliged to distribute a document (probably by email, probably saved as MS word, or a PDF) to several hundred recipients. The recipients are legally obliged to keep it confidential. ...
user avatar
2 votes
1 answer
222 views

PDF User Password always give access to the Owner Password, even when encrypted with AES-128

I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
user avatar
2 votes
1 answer
128 views

PDF Server Side 2020

I have been gathering information on handling PDF files for web applications. Much of my research has been on displaying the files to the user. What I want to learn here is how to properly handle the ...
user avatar
2 votes
0 answers
116 views

PDF Documents - Browser View 2020

I posted a question yesterday about PDF files in a browser that can be found here. There you can find more information about dealing with PDF documents in browser. My question here is how each ...
user avatar
3 votes
1 answer
686 views

PDF Documents in Browser 2020

I have a project where I would like to allow a user to view a document (PDF) in their browser by clicking on a link or thumbnail of the file. They would be able to download said file. Ive just begun ...
user avatar
0 votes
0 answers
57 views

Can flattened pdf documents contain viruses? [duplicate]

While I came to this site from researching whether inactive (or flattened) PDF documents could contain viruses and have come across this link in this site, it does not answer my question. I need to ...
user avatar
  • 101
6 votes
1 answer
238 views

Printing document on usb drive with confidential information on multi user computer

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
user avatar
3 votes
1 answer
3k views

How can we embed an exe containing a payload into a pdf file [closed]

I have created an exe with a payload which gives me a meterpreter session. But I need to embed this exe into a pdf. Upon opening the pdf the exe ideally should get executed. Is there any way to do ...
user avatar
0 votes
0 answers
168 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
user avatar
  • 121
1 vote
1 answer
387 views

How likely are Evince, XReader or Adobe Reader with scripts disabled, to be exploited by a malicious file?

PDFs are very commonly found on the web, and I carefully either view them on the browsers, or use readers without the capability to run the scripts that may come with them (shitty design choice) like ...
user avatar
  • 121
4 votes
1 answer
170 views

Could PDF's `/Filespec` type allow for remote file access?

I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects. As far as I get it, this means that a PDF can make a ...
user avatar
  • 1,331
0 votes
1 answer
322 views

Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)

I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file. The XML file will be used to layout text on the PDF based on variables coming from within the ...
user avatar
5 votes
1 answer
808 views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...
user avatar
  • 329
-2 votes
1 answer
242 views

Reason for fake academic pdf files found on sites like Google Scholar? [closed]

Using my web-browser, I clicked a link on Google Scholar that led to a fake paper (in .pdf format). The pdf contained many keywords and phrases related to the research topic, possibly for search ...
user avatar
3 votes
2 answers
1k views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
user avatar
  • 53
1 vote
1 answer
2k views

Some digitally signed pdfs shown as verified in the pdf viewers while others are not [closed]

I have two pdf documents: 1 - My class 10 marksheet issued by the CISCE that I downloaded through digilocker. 2 - My Domicile certificate issued and downloaded from the aaplesarkar website. Both ...
user avatar
3 votes
1 answer
1k views

Is it safe to view local pdf files in a browser?

When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might ...
user avatar
2 votes
0 answers
103 views

Burst and rebuild pdf to discard eventual embedded malware

This question deals with how to scan, while i am curious if my acrobat reader DC is compromised but in an isolated container and i pull out the pdf. Is it safe to disassemble the pdf by pdftk burst .. ...
user avatar
  • 230
4 votes
0 answers
1k views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
user avatar
  • 41