Wormy attack could spread via PDF

The attack leverages a previously known PDF flaw to spread malware all over a PC

Security researcher Jeremy Conway says he has discovered a way to spread malicious code across PDF documents on a victim's computer.

The attack leverages a flaw in the way the PDF file format works, adding malicious data to legitimate PDF files that could then be used to attack anyone who opens them.

Conway, a product manager with NitroSecurity, had already developed a technique for injecting the malicious commands into PDFs. But his attack only worked when there was some other malicious program on the system that added the code. That all changed last week, when researcher Didier Stevens showed how a PDF document could be altered to run an executable file on a victim's computer.

"When I saw Didier's hack, it was the first time I could do it from completely inside the PDF," Conway said.

Hackers have known for some time that PDF readers could be manipulated in this way, but Stevens' attack showed how one reader -- Foxit Reader -- could launch the executable without even notifying the user. Foxit has now patched this bug, but the underlying flaw in the PDF standard can't be fixed without changing the PDF standard itself.

"This is an example of powerful functionality relied on by some users that also carries potential risks when used incorrectly," a spokeswoman for Adobe Systems said via e-mail.

Users who want to turn off the Adobe Reader or Acrobat feature that allows the attack to work can click "Edit > Preferences > Categories > Trust Manager > PDF File Attachments" and then un-check the box that reads "Allow opening of non-PDF file attachments with external applications."

With version 3.2.1 of Foxit Reader, released Thursday, the software now pops up a dialogue box asking users if they really want to execute the code. Adobe Reader does the same thing.

In a video demo of his attack, Conway shows how he was able to build a malicious PDF document with the executable code that also inserted his own text in Adobe's warning box. By adding text such as "click 'Open' to unencrypt this file," an attacker can increase his chances of getting a victim to open the file.

If a user falls for the trick and allows the executable to run, Conway's attack then acts like a worm, copying a malicious payload to other PDF files on the computer. This malware can be a known PDF attack or something worse. It "could be the next vector for a 0day attack," Conway said.

He believes most enterprises are unprepared to deal with this technique, should it be adopted by cybercriminals. "Most responders are not going to go through every document on a user's computer to make sure it's safe," he said.

He has not released the code for his attack, just the video showing it in action.

The PDF attack could be used to do things such as inject malicious macros into Word documents, said Thierry Zoller, a security consultant with Verizon Luxembourg, speaking via instant message. "You could also easily infect anything else," he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags pdf bugJeremy Conway

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?