New PDFex attack can exfiltrate data from encrypted PDF files

guest · Sep 30, 2019

New PDFex attack can exfiltrate data from encrypted PDF files
September 30, 2019
https://www.zdnet.com/article/new-pdfex-attack-can-exfiltrate-data-from-encrypted-pdf-files/

German academics have developed a new attack that can extract and steal data from encrypted PDF files, sometimes without user interaction.

Named PDFex, the new attack comes in two variations and was successfully tested against 27 desktop and web PDF viewers, including popular software such as Adobe Acrobat, Foxit Reader, Evince, Nitro, and Chrome and Firefox's built-in PDF viewers.

"Our attacks allow the recovery of the entire plaintext of encrypted documents by using exfiltration channels which are based on standard-compliant PDF properties," the research team said.
All of these attacks require that an attacker be in a position to modify encrypted PDF files. This includes a position to intercept the victim's network traffic or having physical access to a storage system (such as device inspections at an airport, accessing an employee's workstation while he's away, and more).

However, saying that these are criteria that diminish the PDFex's usability is wrong. It's exactly these situations that encryption was supposed to protect against, making PDFex a major vulnerability in the PDF standard.
Click to expand...

More details about this research can be found on in a white paper titled "Practical Decryption exFiltration: Breaking PDF Encryption," this blog post, or on the PDF Insecurity website.
Click to expand...

Log in or Sign up

New PDFex attack can exfiltrate data from encrypted PDF files

guest Guest

Log in or Sign up

New PDFex attack can exfiltrate data from encrypted PDF files

guest Guest

Useful Searches