Adobe files (pdf)

• Why pdf files are a security issue?

  • Most if not all machines have a pdf reader (some are vulnerable)
  • Attackers use pdf files to deliver malicious code because: users download them, and so do, automatically. browsers.
  • Malicious pdf files contain JavaScript, but some execute code even without JavaScript.

• The pdf file structure: objects with text, streams, etc

  • Graphical representations: overview, Stevens, Parker, details.
  • To run a JavaScript use <</Type/Action …. JS <</Open/Action << JS … Example of non-malicious use of JavaScript in pdf files.
  • Stevens tools to parse and create JavaScript in a pdf file.

• Mitigating and/or reducing the risks of malicious pdf files

  • Disable JavaScript in the pdf reader, make browser open pdf files in the pdf reader.
  • Use Stevens tool to check for JavaScript in files you mistrust.

Previous slide

Back to first slide

View graphic version