New 'Shadow Attack' can replace content in digitally signed PDF files

guest · Jul 23, 2020

New 'Shadow Attack' can replace content in digitally signed PDF files
15 out of the 28 biggest desktop PDF viewers are vulnerable, German academics say
July 23, 2020
https://www.zdnet.com/article/new-shadow-attack-can-replace-content-in-digitally-signed-pdf-files/

Fifteen out of 28 desktop PDF viewer applications are vulnerable to a new attack that lets malicious threat actors modify the content of digitally signed PDF documents.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
Academics have named this technique of forging documents a Shadow Attack.
Click to expand...

A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.

"The attacker can build a complete shadow document influencing the presentation of each page, or even the total number of pages, as well as each object contained therein."
Researchers say that Shadow Attacks are possible because PDF documents, even when digitally signed, allow unused PDF objects to be present inside their content.

The Shadow Attack is currently tracked with the CVE-2020-9592 and CVE-2020-9596 identifiers.
Click to expand...

This is the second time that this very same research team has broken digital signatures for PDF viewer applications. In February 2019, the same team broke the digital signing mechanism on 21 of 22 desktop PDF viewer apps and five of seven online PDF digital signing services to create documents with fake signatures.

Their new Shadow Attack is different from their first because it doesn't tamper with the digital signature, as the first attack, but with the content of the PDF without breaking the signature.
Click to expand...

Log in or Sign up

New 'Shadow Attack' can replace content in digitally signed PDF files

guest Guest

Log in or Sign up

New 'Shadow Attack' can replace content in digitally signed PDF files

guest Guest

Useful Searches