Another nasty trick in malicious PDF

SweX · Apr 25, 2011

I find this blog post by avast! very informative and interesting. But a bit worrying as well

A new method of producing malicious PDF files has been discovered by the avast! Virus Lab team. The new method is more than a specific, patchable vulnerability; it is a trick that enables the makers of malicious PDF files to slide them past almost all AV scanners.

Overall, PDF specifications allow many different filters (such as ASCII85Decode, RunLengthDecode, ASCIIHexDecode, FlateDecode, …) to be used on raw data. In addition, there is no limit on the number of the filters used for a single data entry. Anyone can create valid PDF files where the data uses, for example, five different filters or five layers of the same filter. All of these features are based on extremely liberal specifications, a fact which allows bad guys to utilize malicious files in a way that does not allow antivirus scanners access to the real payload.

The filter used to encrypt text data is meant to be used only for black and white images. And apart from avast!, probably no other AV scanner is currently able to decode the payload because no other AV can detect those PDF files.
Click to expand...

Rmus · Apr 25, 2011

Note the two exploits referenced in the blog, CVE-2010-0188, CVE-2010-2883.

If you check them out, you see that the tricky code in the PDF results in serving up an executable payload:

CVE-2010-0188: Exploit in the wild
http://blog.fortinet.com/cve-2010-0188-exploit-in-the-wild/

This one decrypts a file (simple xor encryption, see figure below) before effectively dropping it as "C:\a.exe" and starting it. The content of a.exe is also stored in the PDF file.
Click to expand...

Adobe Reader 0-day vulnerability (CVE-2010-2883)
http://www.thesecurityblog.com/2010/09/adobe-reader-0-day-vulnerability-cve-2010-2883/

The shellcode then downloads a fake antivirus onto the user's computer
Click to expand...

Standard protection against unauthorized executable payloads thwarts this "nasty-trick-in-malicious-pdf" at the gate.

regards,

-rich

Log in or Sign up

Another nasty trick in malicious PDF

SweX Registered Member

Rmus Exploit Analyst

Log in or Sign up

Another nasty trick in malicious PDF

SweX Registered Member

Rmus Exploit Analyst

Useful Searches