Questions tagged [pdf]
Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.
173
questions
0
votes
0
answers
3
views
PDF Documents - Photographic Deterrent [migrated]
Is anybody able to recommend an electronic document security package that deters observers from taking photographs of documents?
In the past, I have been made aware that there is a package that masks ...
- 1
0
votes
1
answer
41
views
Fuzzy hash of a file
Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash... or any other) to calculate the hash value of a file, does it calculate the hash based on the whole ...
- 193k
0
votes
0
answers
37
views
How to "clean" PDF to remove non-text and non-images in Product User Manual? [duplicate]
I need guidance on, with the least security risk, how to edit Product User Manuals and Engineering Drawings PDFs from the internet.
Antivirus is insufficient, according to advice from a website which ...
- 127k
1
vote
2
answers
129
views
Check if javascript in pdf is malicious
I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf:
How do I check if this is malicious code?
- 232
0
votes
1
answer
436
views
Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)
I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file.
The XML file will be used to layout text on the PDF based on variables coming from within the ...
CommunityBot
- 1
0
votes
1
answer
333
views
Volatility: AutoMagic Symbol Table error
I am trying to analyze the .vmem file from HoneyNet challenge 3: Banking Troubles (HoneyNet) using volatility3. But I can't seem to get past this error:
PS C:\Users\<user>\Desktop\HoneyNet\...
CommunityBot
- 1
0
votes
2
answers
172
views
When receiving PDFs from unknown sources, is it sufficient to remove dynamic content (flash, JS, etc.) to minimise attack surface?
My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients, and while the image formats ...
CommunityBot
- 1
0
votes
1
answer
52
views
Is it possible to use hashcat or john the ripper on a .drmz file?
I have n .drmz files which I can read with Javelin PDF Reader. Obviously to access the content I need a password, which I have, the same for each file.
In case I don't have the password is there a way ...
- 3
1
vote
1
answer
94
views
Personally identifiable information in a PDF bank statement?
I have got to upload a sample bank statement PDF online which is going to accessible to everyone. I have obviously edited out all account details, names, codes, transaction particulars and the ...
CommunityBot
- 1
0
votes
1
answer
281
views
Safest way to open PDFs on Android and iOS?
I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
- 11
2
votes
1
answer
288
views
Website with embedded PDFs and JavaScript for Acrobat
Context
On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files.
I was wondering if this could come with security issues.
The uploaded PDF are ...
CommunityBot
- 1
59
votes
11
answers
90k
views
How to safely view a malicious PDF?
I have a PDF with important information that may contain malware. What would be the best way to view it?
- 105
1
vote
1
answer
110
views
Secure PDF Document Transmission for US State Government Official
I have been requested to send a copy of a past year tax return to a US state office. I have been in contact with a tax official by email to send this copy through various means. This state is a few ...
CommunityBot
- 1
0
votes
0
answers
187
views
How to inspect for potential malware on pdf attachment?
I received an email at work the other day from a client (with the correct email address) that had a pdf attached. When I opened the pdf, it said the client had required the recipient to login to ...
- 9
4
votes
1
answer
2k
views
What is the difference between PKCS#7 and CADES, PADES and XADES?
I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
0
votes
0
answers
958
views
Android 10 downloaded suspicious files without my permission
This is my first question on this forum so please let me know if I need to clarify anything.
My Android 10 Pixel 2 just downloaded 2 files without my permission today, both named something to the ...
0
votes
2
answers
907
views
Foxit Reader - disable JavaScript / Safely read PDF
Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read.
As some sort of simple check I tried to open a PDF with ...
CommunityBot
- 1
2
votes
1
answer
86
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
- 44k
0
votes
1
answer
885
views
Are there any known vulnerabilities that exploit google's PDF viewer?
I have told my users for years not to ever click on PDF Documents if they are not 100% sure they know where it came from as they can sometimes be the delivery vector for malicious code.
Recently, one ...
1
vote
1
answer
174
views
Can a PDF file make network requests to remote computers?
Do PDF files have the ability to ping a remote server such that the remote server will know that I opened the PDF file? If so, how do I stop that? I am using the Evince PDF reader on my computer that ...
- 18.4k
1
vote
1
answer
167
views
Why do you need to wrap bash command inside another when opening a reverse shell?
In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used:
---js
((require[&...
- 18.4k
2
votes
1
answer
2k
views
What is the format of PDF hash?
When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like:
testing1.pdf:$pdf$2*3*128*-1028*1*16*3ba51ab2b4f9210274ccb07b8da9ec59*32*...
CommunityBot
- 1
1
vote
2
answers
155
views
HSM High Volume Keys
Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
CommunityBot
- 1
7
votes
1
answer
6k
views
Why won't pdf2john extract the password hash of this encrypted pdf? Getting blank results
New to the community, and to JtR and Hashcat as a whole, but after searching for a few days I couldn't find a solution to this specific problem.
I have a password protected PDF file that I'm trying ...
- 1
0
votes
1
answer
98
views
Using PDF files from dubious sources
In one of my university courses, the lecture materials (solutions to homework assignments) are not fully supplied by the university itself, but have to be created by the students themselves: The ...
- 41
1
vote
2
answers
600
views
John The Ripper unable to crack long PDF passwords
Steps I follow:
I protected a PDF with a long password (I am trying with 38 characters password).
I created a dictionary that contains the password to crack the PDF with John the Ripper.
I run john --...
CommunityBot
- 1
7
votes
4
answers
14k
views
How to detect malicious JavaScript in a PDF file?
Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
- 6,337
0
votes
2
answers
1k
views
Is it still possible to embed executables in PDF in 2022?
I have searched and found those posts how to embed exe file to pdf? and https://stackoverflow.com/questions/2941700/can-i-embed-an-exe-payload-in-a-pdf-doc-ppt-or-any-other-file-format, but they are ...
- 193k
8
votes
1
answer
694
views
Security of PDF reader software
Are there any studies regarding the security of PDF viewer software from different vendors? I try to find the most secure reader.
CommunityBot
- 1
20
votes
1
answer
49k
views
How can I extract the hash inside an encrypted PDF file?
As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password.
When auditing security, a good attemp to break PDF files passwords ...
12
votes
1
answer
8k
views
What are the security risks associated with PDF files?
What are the security risks associated with PDF files?
There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
- 8,017
0
votes
3
answers
3k
views
Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?
The answers to Can a PDF file contain a virus? show that clearly it can!
Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
- 127k
0
votes
1
answer
266
views
What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?
I have edited a PDF file in Acrobat, which left some metadata and I am wondering:
What metadata might be possible to discern from the end file if I were to send it to external parties?
What actions ...
- 1,552
3
votes
1
answer
510
views
What encryption method is used on macOS Preview.app?
In order to send a file securely, I am going to encrypt/password protect a PDF file with Preview on macOS.
Other question(s), such as this one have asked the method of encryption for PDF's in ...
CommunityBot
- 1
0
votes
1
answer
271
views
Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)?
Do pdf files pose a higher security risk than regular image files (png, jpeg, etc.)? In my understanding is that most image files don't carry any security risk because all exploits were fixed, but ...
- 11.4k
1
vote
0
answers
298
views
A PDF ran GetAdaptersAddresses. Should I be concerned?
I received and opened a PDF that ran:
GetTickCount
IsDebuggerPresent
SetWindowsHookExW
Sleep
GetAdaptersAddresses
These are the 2 files it wrote:
C:\Windows\ServiceProfiles\LocalService\AppData\...
- 11
1
vote
1
answer
2k
views
Strange virustotal tags on pdf file
I've received PDF at work, which I then ran through virustotal scan out of habit. It turned out to be clean, but at the same time some tags caught my attention, namely:
checks-user-input
detect-debug-...
- 61
1
vote
2
answers
222
views
Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)
For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server ...
- 52.3k
6
votes
2
answers
6k
views
Extract malicious code from PDF file
I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output:
PDF Header: %PDF-1.7
obj ...
- 101
16
votes
2
answers
6k
views
Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?
Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present ...
- 3,790
3
votes
3
answers
9k
views
Gmail warns about encrypted PDF file
I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows:
Encrypted attachment warning – Be careful with this attachment. This message ...
- 126
0
votes
0
answers
519
views
Get encrypted PDF password
For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file.
I used pdf2john.pl to get the password hash and I performed a brute force ...
- 127k
2
votes
1
answer
209
views
How useful is PDF signing in real world usage?
Background scenario:
So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%...
- 1,308
0
votes
1
answer
730
views
Where is the PDF encryption key stored
Assuming you have the user protected PDF file. Using the password, the cryptographic key is generated and the file encrypted. Where is the key stored, is it on the RAM every time the file is opened?
- 58.3k
4
votes
3
answers
2k
views
Is Firefox's new JavaScript support within PDF files a security concern?
Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
- 21
4
votes
2
answers
620
views
How to harden Adobe Acrobat and Acrobat Reader
I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both ...
- 560
0
votes
1
answer
452
views
Is converting malicious PDF to JPG then backwards via web services is good method to obtain safe PDF?
I've downloaded a book but by default its considered malicious by me.
I thought of converting that PDF to JPG here:
https://smallpdf.com/pl/pdf-do-jpg
Then backwards:
https://smallpdf.com/pl/jpg-to-...
1
vote
2
answers
2k
views
What PDF file format alternative should I choose if I am looking for more security in my document files? [closed]
There are tons of exploits being created using the PDF file format for most PDF viewers out there every year. PDF files have lots of power and can utilize things such as JavaScript. This is really ...
- 2,017
2
votes
2
answers
11k
views
Can a computer get infected with malware by viewing a PDF online?
Is it possible for a computer to be infected by viewing the link to a PDF file without downloading it?
For example, if I opened a link on a website such as www.wordpress.com/somepdfFile.pdf (not a ...
- 127k
1
vote
0
answers
1k
views
John the ripper - "no password hashes loaded " for pdf
I'm trying to decrypt a pdf that I no longer have the password for. When I use JohnTheRipper, it can't seem to load any password hashes.
Basically, this is what I run.
└─$ perl pdf2john.pl /home/...
- 127k