162 votes
Accepted

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool. What is Qubes OS? Qubes is an operating system where ...
33 votes
Accepted

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

This is not about HTML. This is the HTML of Google Chrome, and Cloudflare controls the response HTTP headers, as it should, since it's the HTTP server responding to the request. The Report-To header ...
Denis's user avatar
  • 481
20 votes

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

No, this does not look like a security or privacy issue. It seems your PDF viewer is generating an <embed> element and is adding a non-standard headers attribute. This attribute seems to contain ...
amon's user avatar
  • 1,346
19 votes
Accepted

Can you directly view a malicious PDF on Linux?

To say Linux is malware-proof most of the times is incorrect, it's just that much malware focuses on other OS'es (but there is nothing preventing an attacker from targeting more than one OS). Avoid ...
user169339's user avatar
18 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

Safest would probably be a burner device. Grab a cheap laptop, and a mobile internet dongle, use it to download the documents, and manually copy across any contents to your main computer (literally ...
Matthew's user avatar
  • 27.3k
16 votes
Accepted

How can I tell if a PDF file I was sent contains malware?

You can upload a pdf to VirusTotal and check if that file is infected, but be careful since results from VirusTotal are not 100% accurate. There is also PDF Examiner. PDF Examiner by Malware ...
Mirsad's user avatar
  • 10.2k
14 votes
Accepted

How to know if a PDF file is infected?

Analyzing malicious PDF can sometimes be very tricky, attackers are becoming more and more creative in a way of infecting people. But let's make this simple, here are some examples which will ...
Mirsad's user avatar
  • 10.2k
13 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

So, I try to stick with these concerns in the "land of reasonable". With every security issue there is a balance of secure v.s. safe. For example, you could buy a laptop, read one PDF loaded from the ...
coteyr's user avatar
  • 1,556
8 votes

Cracking a password Protected pdf file using John the ripper

Generally the target hash you want to break in the case of a PDF is the user hash, which is derived from the user's password. A PDF will do two things when a password is entered for an encrypted PDF - ...
puzzlepalace's user avatar
8 votes
Accepted

Can a computer get infected with malware by viewing a PDF online?

Obviously if you are viewing the PDF in your browser, you could get attacked. Browsers are imperfect, and the PDF format is filled with vulnerabilities (that continue to be found.) However, it's ...
John Deters's user avatar
  • 34.2k
8 votes

Can a PDF embed a tracking image?

Can a PDF contain something that tracks you? If you mean in the PDF file itself, and part of the PDF standard, and which does not require the user to click on something (like a link annotation), it ...
Ryan's user avatar
  • 181
7 votes
Accepted

How to detect malicious JavaScript in a PDF file?

I did some additional searching and found an interesting research-paper (easily readable and just 12 pages). The research is called Detecting Malicious JavaScript in PDF through Document ...
Bob Ortiz's user avatar
  • 6,665
7 votes

How to safely view a malicious PDF?

A simple and straightforward way to open possibly malicious PDFs on a Windows computer is to use the Sumatra PDF viewer. Sumatra is a small, lightweight PDF viewer that has no support whatsoever for ...
barbecue's user avatar
  • 629
7 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

Using CubeOS and disposable VMs is a good approach. Some other options (which can be combined with the CubeOS/DisVM one) : Disarm the PDF You can use ghostscript for that : gs -dNOPAUSE -dBATCH -...
jfs's user avatar
  • 71
7 votes
Accepted

Is there a best practice regarding PDF files on website?

It's generally safer to force-download files, than to view them directly in the browser. However, in the case of PDFs, the PDF viewers in Firefox and Chrome are probably safer and more up-to-date than ...
Neil McGuigan's user avatar
7 votes

How to know if a PDF file is infected?

After a little looking it appears that the tool you are using to investigate this PDF document is standalone python(?) tool written by a "security researcher". I put that title in quotes simply ...
Conor Mancone's user avatar
7 votes
Accepted

Does embedding images in PDF retain metadata?

Yes, EXIF data may be saved, depending on how your PDF tools work. As an example, you can take a JPEG with EXIF data, put it into LibreOffice Writer, then save that document as a PDF with "Lossless ...
Polynomial's user avatar
  • 135k
6 votes

Can you directly view a malicious PDF on Linux?

Whether or not the PDF is safe to open depends on whether or not your environment (i.e. Linux and your PDF software) is vulnerable to the exploit. Linux is not malware-proof; it just happens that most ...
bendodge's user avatar
  • 161
6 votes
Accepted

Malicious PDF file upload

Run them all through a converter into PDF/A format. It forbids any sort of active content. If they won't convert, trash them. IDS/IPS with Anti-Malware license Scanning is a losing battle. No ...
PushfPopf's user avatar
  • 300
5 votes

Is this attack vector possible?

Is this attack vector possible? I would say it is possible because there is no 100% secure software. In this specific case you are using Evince which is using the poppler PDF library which had ...
Steffen Ullrich's user avatar
5 votes
Accepted

Securing online PDFs

I understand online PDFs are prone to malware. Do you have a reference (or some background) for this statement? As discussed in this question, a PDF certainly can be made to include malware, but I ...
iwaseatenbyagrue's user avatar
5 votes

Is it safe to view local pdf files in a browser?

It is generally considered safer to open PDFs in browsers, because they are better sandboxed than the other PDF readers installed on your computer. The sandbox should prevent the browser to access ...
A. Hersean's user avatar
  • 10.6k
5 votes

How to harden Adobe Acrobat and Acrobat Reader

Disabling JS is actually a very good idea. If you still want to add some extra protection I would recommend: Set the security options to the highest level. Acrobat Reader implements a sandbox mode, ...
borcho's user avatar
  • 590
4 votes

Cracking a password Protected pdf file using John the ripper

John works on different kinds of hashes. You can extract the hash from pdf file using utility like pdf2john and then start cracking with john as usual. Relevant - How can I extract the hash inside ...
proslaniec's user avatar
4 votes

How to detect malicious JavaScript in a PDF file?

There can be legitimate JavaScript in a PDF. An invaluable tool is pdfinfo, part of poppler-utils. First of all, it tells you whether a pdf file contains any JavaScript at all. In case, pdfinfo -js ...
Ale's user avatar
  • 141
4 votes

How do digital signatures on PDF documents work?

Don't be sure that you digitally signed the document. Adobe Reader and related products also include echoSign features. EchoSign is an electronic (not digital) signature system. If you still have the ...
Larry K's user avatar
  • 601
4 votes

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

Converting all the PDFs to some more "passive" format - maybe TIFF or postscript - could be done in batch, in a restricted account either on the local machine or on some linux box/VM. An exploit/...
rackandboneman's user avatar
4 votes
Accepted

Is a PDF creating service vulnerable for injection of malicious code

I have worked with many PDF libraries (not this one exactly though) mainly in .NET and if done correctly are fine. If you are worried about having the client side HTML sent back to the server and it ...
ISMSDEV's user avatar
  • 3,270
4 votes

Is a PDF creating service vulnerable for injection of malicious code

Make sure your web services is not susceptible to XSS injections. You must find ways to prevent abuse(since this become web services), e.g. use API key control, to prevent anyone upload any HTML ...
mootmoot's user avatar
  • 2,397

Only top scored, non community-wiki answers of a minimum length are eligible