Questions tagged [pdf]
Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.
174
questions
161
votes
14
answers
18k
views
What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?
As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them ...
- 1,389
85
votes
3
answers
298k
views
72
votes
3
answers
38k
views
What security scheme is used by PDF password encryption, and why is it so weak?
Many PDFs are distributed as encrypted PDFs to lock out some of their functionality (eg printing, writing, copying). However, PDF cracking software is available online, which usually cracks the PDF ...
- 1,685
59
votes
11
answers
90k
views
How to safely view a malicious PDF?
I have a PDF with important information that may contain malware. What would be the best way to view it?
user11101
46
votes
5
answers
83k
views
How to scan a PDF for malware? [closed]
Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF?
I would prefer a free ...
- 99.1k
20
votes
4
answers
8k
views
Detecting and preventing 'phone home' behavior in PDF files
I have received several PDF documents via email from someone I do not trust. I need to read the documents and respond to them. They are not encrypted.
I want to make sure the documents are ...
- 201
20
votes
1
answer
49k
views
How can I extract the hash inside an encrypted PDF file?
As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password.
When auditing security, a good attemp to break PDF files passwords ...
20
votes
3
answers
38k
views
How can I tell if a PDF file I was sent contains malware?
I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How ...
- 303
19
votes
2
answers
62k
views
How to know if a PDF file is infected?
I'm afraid to open a PDF book. When checking the file via pdfid, I get this:
PDF Header:% PDF-1.6
obj 4175
endobj 4174
stream 3379
endstream 3379
xref 0
trailer 0
startxref 1
/...
- 305
19
votes
2
answers
6k
views
Effectiveness of flattening a PDF to remove malware
I'm currently looking at ways to prevent malicious PDF files at the network boundary. This will include virus scanning - but there are known limitations to that. I see a common approach is to flatten ...
- 18.5k
16
votes
2
answers
6k
views
Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?
Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present ...
- 291
16
votes
1
answer
2k
views
Malicious PDF Analysis
I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to ...
- 263
15
votes
8
answers
3k
views
Document security - how to find who's leaked a confidential document?
I am legally obliged to distribute a document (probably by email, probably saved as MS word, or a PDF) to several hundred recipients.
The recipients are legally obliged to keep it confidential. ...
- 251
12
votes
1
answer
8k
views
What are the security risks associated with PDF files?
What are the security risks associated with PDF files?
There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
11
votes
3
answers
8k
views
Can you directly view a malicious PDF on Linux?
There have been questions on safe viewing of malicious PDFs on OS. I would like to know if it's okay to directly open them to view them in a Linux OS because the OS is said to be secure and malware-...
- 213
9
votes
2
answers
24k
views
How secure a secured PDF really is? [duplicate]
I've googled the internet for answers regarding secured pdf/cracking them and found huge amount of stuff. But most of it is quite old. So could someone confirm the following is still valid in modern ...
- 191
8
votes
1
answer
411
views
Is there a best practice regarding PDF files on website?
When a website supplies a PDF there are two options for how a user might interact with it:
View it in browser
Download it
As the host of these files is there a security advantage one way or the ...
- 727
8
votes
1
answer
3k
views
PDF file encrypted with my password, does that mean my password is stored in plaintext?
Every month, I receive an encrypted Portable Document Format (PDF) file with my payslip. I can open the file for reading with my password. Without providing my password, I cannot open the file at ...
- 1,830
8
votes
1
answer
5k
views
Does embedding images in PDF retain metadata?
I have a PDF file which I can select images to embed in. The customers are not technical so I do not want them to remove metadata themselves (e.g. GPS location of photos, etc). Will the PDF ...
- 485
8
votes
1
answer
694
views
Security of PDF reader software
Are there any studies regarding the security of PDF viewer software from different vendors? I try to find the most secure reader.
- 81
7
votes
2
answers
21k
views
Cracking a password Protected pdf file using John the ripper
What exactly happens after I provide the hash from the pdf file to John for cracking the password?
Does John extract just the password hash from the file and work on it, or is there something else?
- 119
7
votes
4
answers
3k
views
Remove pdf malware by re-printing to new pdf or text extract?
Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either:
open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program "print-...
- 861
7
votes
1
answer
6k
views
Why won't pdf2john extract the password hash of this encrypted pdf? Getting blank results
New to the community, and to JtR and Hashcat as a whole, but after searching for a few days I couldn't find a solution to this specific problem.
I have a password protected PDF file that I'm trying ...
7
votes
4
answers
14k
views
How to detect malicious JavaScript in a PDF file?
Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
- 6,337
6
votes
1
answer
373
views
Printing document on usb drive with confidential information on multi user computer
I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
user103128
6
votes
1
answer
3k
views
Bank Has Emailed My Social Security Number
I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
- 245
6
votes
2
answers
6k
views
Extract malicious code from PDF file
I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output:
PDF Header: %PDF-1.7
obj ...
- 161
6
votes
1
answer
2k
views
Can I redact by converting PDF to TIFF and back?
Background
My boss asked me to come up with a way ordinary users can redact information from PDF files using free software. We get a lot of scanned documents and our client requires that sensitive ...
- 2,100
5
votes
3
answers
6k
views
Detected virus in pdf - should I be worried (CVE-2014-8449)?
I downloaded a pdf earlier, and I was trying to send it to my friend, but gmail said that it detected a virus. So I ran it through virustotal.com and only 1 out of 56 scanners came up with a virus - ...
- 51
5
votes
1
answer
1k
views
Can a PDF embed a tracking image?
I know that PDFs can contain embedded images and Javascript.
Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
- 99.1k
5
votes
1
answer
947
views
Verification of a timestamped PDF
I'm kinda new to the process of timestamping files to provide digital integrity.
For testing purposes, i use tsa.safecreative.org for PDF files.
Now i've signed a couple PDF files and if i open up ...
- 588
5
votes
1
answer
3k
views
Standard to represent digital signature on paper
Users are making a deal using the website. Website generated PDF file (something like contract or report). Users perform digital signing of this file (analogous to hand-written signature on paper ...
- 257
5
votes
1
answer
3k
views
How do digital signatures on PDF documents work?
I recently filled out a PDF document which required me to append a digital signature. The PDF document had a link embedded in it that I clicked and went through the process. I am curious how this ...
- 1,556
5
votes
1
answer
2k
views
How strong is PDF security/encryption?
I want to securely convey a PDF document containing sensitive information from my system to another system. The latter is operated by a different person, whom I trust. However, this person does not ...
- 205
5
votes
1
answer
1k
views
Can the conversion of a malicious PDF to image be exploitable?
Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do:
Convert the PDF to image using a library and store it in my file server as an image? ...
- 329
5
votes
0
answers
200
views
How to safely store the most recently used encryption password for subsequent reuse in an app?
Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
- 2,068
4
votes
3
answers
1k
views
Is a PDF creating service vulnerable for injection of malicious code
We have a report in our web application that being shown in tabular format in HTML. This report has the provision to be downloaded as PDF by clicking the download as PDF button. The question is about ...
4
votes
2
answers
5k
views
Malicious PDF file upload
I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from ...
- 45
4
votes
2
answers
621
views
How to harden Adobe Acrobat and Acrobat Reader
I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both ...
- 403
4
votes
2
answers
10k
views
Removing malware from a malicious PDF file [duplicate]
I have analyzed a large PDF using Didier Steven's pdfid tool. I get the following result:
Now that I know there is malicious content in the PDF, what can I do to remove it? I would still like to view ...
- 141
4
votes
1
answer
2k
views
Is it safe to view local pdf files in a browser?
When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might ...
- 41
4
votes
2
answers
3k
views
How to remove meta and sensitive data from PDF file?
I've some PDF files generated from different sources (such as web-browser, Photoshop, etc.) on Unix.
How do I make sure PDF doesn't contain any sensitive information such as IP address, OS, user name,...
- 43
4
votes
3
answers
2k
views
Is Firefox's new JavaScript support within PDF files a security concern?
Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
4
votes
2
answers
156
views
what kind of signature to require in a medical B2C environment
I can't seem to find what is standard practice regarding signing/validating pdf files in a medical B2C environment. (A chiropractor's practice counts as medical, doesn't it?)
I find quite a bit about ...
- 141
4
votes
1
answer
184
views
Could PDF's `/Filespec` type allow for remote file access?
I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects.
As far as I get it, this means that a PDF can make a ...
- 1,351
4
votes
1
answer
2k
views
What is the difference between PKCS#7 and CADES, PADES and XADES?
I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
- 41
4
votes
1
answer
2k
views
Execute Shellcode embedded into a picture? [duplicate]
Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
- 57
4
votes
1
answer
806
views
Exploit user input being directly inserted into PDF
I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded.
The user input is accepted as is, without encoding or any other modification. This ...
- 159
4
votes
2
answers
2k
views
What is a secure method to send pdf files with private information? [duplicate]
An employer wants me to send an i-9 form, which has my social and date of birth, via e-mail to their HR department. This seems quite baffling to me why they would want me to just send the form in ...
- 143
3
votes
1
answer
947
views
How to de-obfuscate a malicious payload?
I've received some spam email that led to a JavaScript file which I assume is malicious.
My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
- 33