PDFex attacks can exfiltrate encrypted data in plaintext
The integrity of password-protected payslips, medical files, and other sensitive documents has been called into question, as researchers claim to have broken the PDF encryption standard.
A team of academics from the Ruhr University Bochum and the Münster University of Applied Sciences in Germany this week unveiled new research that demonstrates “severe weaknesses” in PDF encryption.
The researchers developed these vulnerabilities into two so-called ‘PDFex’ attacks, which can enable an unauthorized party to exfiltrate encrypted PDF data in plaintext, without knowing the password.
As outlined in the PDFex research post and accompanying white paper (PDF), the first technique entails wrapping the encrypted part of a target document within attacker-controlled content.
Once the document is opened by a legitimate user, the contents are exfiltrated in plaintext.
The second method leverages a separate flaw in the PDF encryption specification to manipulate encrypted content, causing it to be leaked to an attacker-controlled server.
Impacted PDF viewers
During the course of their research, the PDFex team tested their exploits on 27 widely used PDF readers, including Adobe Acrobat and Foxit Reader, along with in-built PDF readers from popular browsers.
Of these targets, the researchers found that 23 (85%) readers were vulnerable to the first exploit, and all 27 of them were vulnerable to the second attack.
Discussing the PDF security shortcomings, the researchers said: “Many data formats allow to encrypt only parts of the content. This encryption flexibility is difficult to handle and allows an attacker to include their own content, which can lead to exfiltration channels.
“Second, when it comes to encryption, AES-CBC – or encryption without integrity protection in general – is still widely supported. Even the latest PDF 2.0 specification released in 2017 still relies on it.”
They added: “This must be fixed in future PDF specifications and any other format encryption standard, without enabling backward compatibility that would re-enable CBC gadgets.”
RELATED Foxit PDF reader devs admit data breach impacted users
