Malicious PDF file doesn't need a software vulnerability

Adobe's Reader displays a warning before the attack code runs, but that message can be manipulated to allay suspicion

A security researcher has found a way to run arbitrary code on Windows computers by embedding it in a malicious PDF file.

The code will run when viewed in two popular PDF reader applications, but the author of the hack says it doesn't exploit a software vulnerability.

PDF readers from Adobe Systems and Foxit don't allow embedded executables to run directly, wrote Didier Stevens on his security blog. But Stevens found a way to get an embedded executable to run via a different launch command.

Upon opening the rigged document, Adobe Reader will display a warning message saying that launching code could harm the computer, so a user would need to approve launching an application. But Stevens found he was able to change part of the message, which could be modified to persuade the user to open the executable.

In his example, Reader will launch a harmless calculator program, but that could be replaced with malicious software. Stevens' proof-of-concept code worked using Adobe Reader 9.3.1 on Windows XP SP3 and on Windows 7.

Foxit's PDF reader does not display a warning, but as the proof-of-concept code was originally written, the executable would not run, likely "due to some variation in the PDF language supported," Stevens wrote.

By Wednesday, Stevens had fixed that problem, which allows an executable to be launched in Foxit merely by opening the manipulated PDF.

Stevens has notified the two software companies.

"I've reported it to Foxit Software, and they told me they will issue a fix this week. I don't know what the fix will be, but I assume it will be a warning message, to be in line with the other PDF readers," Stevens said via e-mail.

Stevens hasn't released the proof-of-concept code, but it is possible that someone could figure it out.

However, "it's not easy. To give you an idea without getting too technical: it takes me 5 different steps to execute arbitrary code. The test PDF file I published on my blog contains just the first step," Stevens said.

In a statement, Adobe said that Stevens' demonstration relies on functionality defined in the PDF specification, which is an International Organization for Standardization standard named ISO PDF 32000-1:2008. That specification also defines the launch command.

"This is an example of powerful functionality relied on by some users that also carries potential risks when used incorrectly," according to the statement. "The warning message provided in Adobe Reader and Adobe Acrobat includes strong wording advising users to only open and execute the file if it comes from a trusted source."

Join the PC World newsletter!

Error: Please check your email address.

Tags pdfadobepdf bugmalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?