 |  |  | |  | Education -> PDF security flaws |  |
 | |
| |
This page contains information on flaws and cracks in Adobe PDF Security.
It also covers PDF Security news articles on other companies using the Adobe PDF plug-in / security handler and how they have been compromised. News on PDF ebook security is also covered here as well as third party PDF DRM suppliers.
For an up to date list of Adobe Reader security advisories please see Adobe's web site
PDF Security Flaws, PDF & Ebook Weak Implementations
Bypassing Adobe Security controls on the Mac
This paper explains how to bypass Adobe PDF Security using a Mac computer.
How the Adobe PDF Security Handler works
"Adobe's PDF protection scheme is a classic example of security through obscurity. They encrypt the content of a PDF file and hope that no one figures out how to decrypt it." This paper explains how Adobe encrypts PDF files.
10 things you really wished you had known about PDF DRM, but they didn’t tell you
This paper explains the current pitfalls of PDF security. If the PDF security solution you decide on can be circumvented by simple means, or is complex to setup and use then you might want to look elsewhere.
PDF Security plug-in vulnerabilities
If you think PDF plug-ins can't compromise your security then perhaps you should read this.
How Secure Is PDF?
This paper discusses the flaws in the Acrobat Standard Security handler.
Analysis of E-book Security
This paper makes a survey on main e-book standards, application architectures and security mechanisms. The security strength and weakness of the investigated e-book systems are analyzed and presented.
Adobe PDF Security Security Flaws & Cracks - 2010
Secure PDF Reader released by Nuance stops JavaScript - February 2010
Nuance has released a Free Secure PDF Reader which addresses a troubling PDF security issue found within some readers by giving users the option to prevent JavaScript installation – something the Adobe PDF viewer does not do. Preventing JavaScript installation creates a safer PDF environment for the end user and adds an additional safety net for IT professionals looking to safeguard their organizations. Hackers have used the PDF JavaScript vulnerability to gain control of a user’s computer – exposing users to system attacks and the transfer of personal information simply by viewing infected PDF files.
Javascript yet again compromises PDF security - January 2010
Yet again, the use of JavaScript in PDF documents has compromized the security of users computers. A new JavaScript exploit that can be hidden in PDF files and exploit a widely documented PDF vulnerability is making the rounds. Only 6 out of 40 anti-virus vendors can detect the malicious javascript. This is just one of many security reasons to make sure javascript is disabled in Acrobat!
Adobe PDF Security Security Flaws & Cracks - 2009
Internal disk path location exposed by lack of PDF security - November 2009
The privacy issue arises from the fact that your local disk path gets invisibly embedded inside your PDF files in the title attribute. When users print your PDF documents the local disk path is displayed. Users can also open your PDF documents in a text editor (i.e. notepad) to display your local disk path.
PDF DRM product exposes users computers to potential security risk - May 2009
Users must enable JavaScript to view ProtectedPDF documents. This exposes users to JavaScript-based vulnerabilities in Acrobat Reader, as well as possible loss of privacy.
Adobe security teams tells users to disable javascript in Adobe Acrobat Reader - April 2009
The latest vulnerability employs a JavaScript error which can enable malicious code execution on Windows, Mac and Unix clients. Whilst Adobe are recommending that users disable javascript in Adobe Reader until another patch is released, other security advisors are suggesting that JavaScript be removed from PDF Readers completely as a permanent solution. The Sophos 2009 Security Threat Report, warned that hackers are increasingly looking at commonly used browser plugins like Adobe Flash and PDF in their attempts to infect innocent computer users.
Security company tells users to stop using Adobe Acrobat Reader - April 2009
Of the targeted attacks so far this year, more than 47 percent of them exploit holes in Acrobat Reader while six vulnerabilities have been discovered that target the program, Mikko Hypponen, chief research officer of security firm F-Secure, said in a briefing with journalists. Top-level executives, defense contractors, and other people who have access to specific sensitive corporate or government information are subject to targeted attacks where an attacker sends a file that has malicious code embedded in it. Once the file is opened, the computer is infected typically with a back door that then steals data.
PDFs under attack yet again - March 2009
A critical vulnerability identified in Adobe Reader 9 and Acrobat 9 as well as earlier versions will call the aforementioned applications to crash and could allow an attacker to take control of the affected systems. Adobe also acknowledged that there are reports the vulnerability issue is already being exploited.
PDF file can install malware without you even opening it! - March 2009
Because of the way Windows file explorer works, infected PDF files can be executed without even clicking on them. The exploited files use JavaScript heap spraying to facilitate arbitrary code execution.
Ziff Davis Enterprise serves Acrobat exploit through a malicious PDF file - February 2009
Ziff Davis and other advertising companies were found to be serving PDF exploits through advertisements on their sites. The malicious PDF served did not exploit the most recent PDF flaw that hit the news on February 20th but a much older one that uses JavaScript to install malware on the users computer.
Adobe PDF Security Security Flaws & Cracks - 2008
Adobe 9 has 100 times weaker security than previous version - November 2008
ElcomSoft, the company that discovered a security weakness in Adobe's eBook software back in 2001, has found vulnerability in another Adobe Product. While Adobe advertises Acrobat 9 as the most secure PDF production tool ever with enhanced 256-bit encryption, ElcomSoft has discovered that the new PDF protection system implemented in Acrobat 9 is even faster to recover than in previous versions. In fact, a hundred times faster. "The new version of Adobe Acrobat is easier to break", claims ElcomSoft CEO Vladimir Katalov, quoting a speed increase of two orders of magnitude for the new format. "The new product has surprisingly weak protection", he adds. According to ElcomSoft's CEO, using 256-bit AES encryption per se is not enough to achieve ultimate security without employing complex approach and consideration of the entire security system.
Bugs in Adobe PDF exploited by hackers - November 2008
Malicious hackers have targetted the PDF format yet again, exploiting the latest patches released from Adobe. At least one of the hacks is not quarantined by anti-virus software and enables the attacker to take control of the affected system as per the non-patched versions in May of this year.
PDF exploits on the rise - September 2008
Adobe has patched 17 security vulnerabilities in the Windows version of its Reader 8 software so far this year, in four separate patches. New toolkits appearing on the market specifically target vulnerabilities in PDF files to gain access to user's computers and Adobe's use of allowing more sophisticated technology to run within PDF files is to blame.
Adobe PDF flaw could allow an attacker to take control of your system - May 2008
Critical vulnerabilities have been identified in Adobe Reader and Acrobat 8 and 7. These vulnerabilities would cause the application to crash and could allow an attacker to take control of the affected system.
Adobe PDF exploit infects 'many thousands,' says researcher - February 2008
The vulnerabilities were in Adobe Reader and Acrobat's handling of JavaScript and in how it refers to libraries that provide encryption and signature verification. "Exploitation of these vulnerabilities would allow an attacker to execute arbitrary code as the current user," the iDefense advisory said.
PDF attacks more likely in the future - January 2008
The recent Adobe patch has done little to ease the fear of security concious users. Exploit-laden PDF files will become more common in spear phishing attacks in the future since the Portable Document Format (PDF) is a de-facto standard for exchanging electronic documents online. PDF files have traditionally been unfiltered at the gateway and until recently were considered risk free–in contrast to the notorious history associated with Microsoft Office documents. With the release of Windows Vista and Microsoft Office 2007, however, Microsoft has made it more difficult for attackers to use buffer overflow exploits. Therefore exploit writers are more likely to target the lower hanging fruit. Exploiting vulnerabilities in popular applications from Adobe, Apple, or RealPlayer are proving to be just as advantageous and profitable.
Adobe PDF Security Security Flaws & Cracks - 2007
PDF Bug Compromises Windows PCs without users knowledge - September 2007
A PDF vulnerability in Adobe's Acrobat Reader has come to light that can lead to Windows PCs getting taken over completely without the users knowledge. All it takes is to open a maliciously rigged PDF document or stumble across a page which embeds one. Paul Henry, vice president of technology and evangelism at Secure Computing warned, the PDF threat is real. "The ability to use PDFs to install malware and steal personal information from remote PCs is here," he said in a statement. "Readers should be cautioned to only open PDF files from senders they explicitly trust."
Adobe 8 PDF password security broken - July 2007
A single click of a button in pdf-Recover will remove the password, regardless of whether it has been encrypted using 40-bit RC4, 128-bit RC4 or even the latest 128-bit AES Adobe 8 Generation technology. The result is an exact replica of the original PDF without any security settings whatsoever – pdf-Recover removes all of the restrictions implemented. The program is available for Windows 95 and later, MacOSX and Linux, and costs €19.
Latest critical Acrobat flaw puts user's computers at risk - June 2007
Another critical security vulnerability in Acrobat can let attackers crash vulnerable applications and execute arbitrary commands.
Deal plans revealed in Joost's PDF documents - May 2007
Another company falls foul of the PDF format not realizing that hidden text can be easily revealed by copying it into notepad.
Latest Acrobat Reader vulnerability puts user's files at risk - January 2007
Links with malicious Javascript can access the user's local machine and used to read files, delete them, execute programs, send the contents to the attacker, etc. The security problem exists because the Web browser plug-in of the Adobe Systems' Acrobat Reader allows JavaScript code appended to links to PDF files to run once the link is clicked.
PDF Security and Ebook Security Flaws & Cracks - 2006
Adobe drop Acrobat Reader in DRM secure ebook product - October 2006
For Adobe's latest secure ebook product, Digital Editions, Acrobat Reader is not supported. Instead, users will have to download a new viewer that enforces DRM controls. Adobe state the 20MB+ file size of Acrobat Reader as one of the reasons they are not using it, but one suspects the fact that Acrobat Reader was not built with security in mind could be another.
Malicious code can be launched in at least 9 ways in PDF files - September 2006
Whilst Acrobat is rich in features it is these very features that leave it open to attack. A malicious user can manipulate legitimate features in Adobe PDF files to open back doors for computer attacks. Malicious links (once the document is opened, the target's browser is automatically launched and loads the embedded link), attacks that use Adobe Systems' ADBC (Adobe Database Connectivity) and Web Services support, use of HTML forms and file system access are just some of the ways Acrobat can be compromised by a malicious user.
ElcomSoft release PDF password cracker that breaks 128 bit encryption - August 2006
The utility borrows all the idle processing bandwidth on a network to brute-force-attack a password-protected PDF. ElcomSoft CEO Vladimir Katalov says that the tool wasn't designed to enable mischief makers, but rather, to combat mischief itself. From his security expert's point of view, however, he opines that document-level password protection technically isn't DRM (digital rights management). And because of the plug-in architecture of Acrobat and PDF readers, it makes PDF a less-secure platform for DRM.
Full details of the product and pricing information can be found at ElcomSoft's web site.
Acrobat flaw could result in remote code exectuion - July 2006
Adobe released a patch on 11th July for a flaw that could allow a malicious PDF document to trigger buffer overflow. The overflow could cause Adobe Acrobat to crash and result in remote code execution if malicious content is inserted into a PDF file, according to the Adobe advisory. The flaw is considered critical by the company.
Acrobat secure PDF files compromised with "view as HTML" function - April 2006
Acrobat secure PDF files that are received in Gmail can be viewed as HTML if the "View as HTML" link is selected. The full document is displayed as HTML even if the original PDF is secured against content copying or extraction. Respecting security permissions on a PDF file is therefore something that must be done on a "honor" basis by the application!
Adobe PDF Security Flaws & Cracks - 2005
Adobe Acrobat user gaffe exposes classified Defense information - May 2005
A military report on an investigation into the shooting death of an Italian security agent includes blocks of classified data that can be deciphered as easily as copying and pasting text. Multinational Forces-Iraq issued the report in Adobe Portable Document Format on April 30 as an unclassified document, with blocks of classified redacted information obscured from public view. But copying and pasting the classified sections into Microsoft Notepad reveals the blocked text. The breach was discovered by an Italian blogger shortly after the report was posted.
Wiley's ebooks cracked despite using "secure" PDF DRM - May 2005
Wiley Publishers acknowledge that the protection used in FileOpen PDF DRM is not up to much - the pirated ebooks are available before the print books are distributed to all the bookstores who have ordered them.
FileOpen Publisher and Adobe PDF Security Flaws & Cracks - 2004
$20 Million Copyright Award A Boost To Publishers - September 2004
Specialized-information publishers won another weapon in their fight to protect their products from copyright violations last week when a federal court jury in Baltimore awarded NEPA member Paul Desmond a nearly $20 million judgment against financial-services firm Legg Mason Inc. for violating his company’s copyright. Desmond, president of Lowry’s Reports, Inc., of North Palm Beach, FL, sued Baltimore-based Legg Mason after receiving reports that the company had been systematically circulating and putting on its intranet electronic copies (PDF) of Lowry’s Market Trend Analysis, a daily e-mail stock market commentary, for more than a decade.
Flaw in FileOpen Publisher allows 'secure' PDF documents to be opened without a key - September 2004
A serious flaw in FileOpen Publisher allows users to open "protected PDF documents" without entering an authorization code.
Adobe Plug-ins compromised - July 2004
There are many Adobe Acrobat and Adobe Reader plug-ins that can load (by design) only in certified mode. One example is all documents protected with "Adobe DRM" security handler (so-called eBooks). Certified mode assures that all other plug-ins, loaded with those ones, have been also certified by Adobe. However, with this vulnerability, the plug-in with forged signature can perform virtually everything, including but not limited to:
- removing or modifying any restrictions (from copying text to Clipboard, printing etc) from the documents loaded into Adobe Acrobat or Adobe Reader;
- remove any DRM (Digital Rights Management) schemes from PDF documents, regardless the encryption handler used - WebBuy, InterTrust DocBox, Adobe DRM (EBX) etc;
- modify or remove digital signatures used within a PDF document;
- affect any/all other aspects of a document's confidentiality, integrity and authenticity.
The official US-CERT posting can be viewed here along with Adobe's response
FileOpen is just 'snake oil' - April 2004
"FileOpen protection (including one implemented in expensive and "very secure" WebPublisher can be removed either instantly or in a matter of a few hours -- without Adobe Reader, FileOpen plug-in itself or whatever. I'd call it "snake-oil" (see Bruce Schneier's definition of the term) because of multiple vulnerabilities. Their main protection is DMCA - Digital Millennium Copyright Act. ;)" - Vladimir Katalov, Managing Director, ElcomSoft Co.Ltd.
Adobe PDF Security Vulnerabilities - 2003
Adobe Acrobat and PDF security: no improvements for 2 years. Software released in 2003 contains vulnerabilities disclosured in 2001 - July 2003
In early 2001, Elcomsoft discovered a serious security flaw in Adobe Acrobat and Adobe Acrobat Reader. In July 2001, they briefly described it in "eBook Security: Theory and Practice" speech on DefCon security conference. Since there was no reaction from Adobe (though Adobe representative has attended the conference), they reported this vulnerability to CERT in September 2002 (after more than a year), still not disclosing technical details to the public. Only in March 2003, CERT Vulnerability Note (VU#549913) was published, and after a week, Adobe has responded officially (for the first time) issuing the Vendor Statement (JSHA-5EZQGZ), promising to fix the problem in new versions of Adobe Acrobat and Adobe Reader software expected in the second quarter of 2003. When these versions became available, whilst some minor improvements have been made, the whole Adobe security model was still very vulnerable, and so Elcomsoft sent a follow-up to both CERT and Adobe. Both parties failed to respond.
Adobe PDF Ebook Security Cracks - 2002
ElcomSoft acquitted - December 2002
In a blow to a controversial copyright law, a federal jury in San Jose on Tuesday acquitted a Russian firm of charges that it sold software designed to crack security on Adobe Systems' electronic book technology.
Russian firm points out new Adobe flaw - July 2002
Thumbing its nose at the company that landed one of its employees in jail, ElcomSoft is pointing out new flaws in Adobe Systems' eBook software. The flaws could allow someone to check out every copy of every book in Adobe's new electronic library for an unlimited amount of time by changing the values in the loan form.
PDF Security, FileOpen and Ebook Security Flaws & Cracks - 2001
FileOpen Publisher and E-Book Security Pro weaknesses exposed - August 2001
Ebook Pro - "The $197 e-book protection software is advertised as 100% burglarproof and claims a list of Fortune 500 companies as its customers. Sklyarov found that the software "encrypts" e-books by mixing each byte of the text with a constant byte. This is a technique so weak that it probably shouldn't even be called cryptography."
FileOpen Publisher - "The code can be broken instantly. FileOpen software, puts key information in the encrypted document, which is sort of like leaving your car with the keys in the ignition. FileOpen was chosen as an Adobe "security partner", which leads me to wonder how closely Adobe examines the cryptography used by its partners."
Adobe PDF Security and FileOpen cracked - August 2001
Feds arrest Russian cracker for breaking Adobe's PDF security controls. Last year ElcomSoft produced a piece of software that cracked FileOpen's code -- potentially driving it out of business.
Adobe FAQ: ElcomSoft legal background
FileOpen Systems responds to ElcomSoft PDF decryption - July 2001
FileOpen Systems condemns the actions of ElcomSoft in releasing software to remove encryption from PDF files.
ElcomSoft's Adobe PDF decryption banned in the US but not in Europe - July 2001
"In Germany and Scandinavia, our software is absolutely legal. We have requests from different companies who are ready to translate this program to German and distribute it in Germany without any limitations."
eBook security is an absolute joke and is even weaker than the standard PDF security - July 2001
It appears that the security placed on Adobe Acrobat eBook Reader files is not stronger but feebler than that for PDF files.
Cracks and flaws reported on Adobe PDF Security, Adobe DRM, FileOpen, FileOpen Publisher, FileOpen WebPublisher, PDF plugins, and poor PDF security and secure ebook implementations. Adobe vulnerabilities and PDF password crackers. | |
| |  | |  |
Home | Products | Purchase | Downloads | Education | Compliance | Our Customers | About Us | News | Support | Related Info  Privacy Policy SITE MAP
|
