Wormy attack could spread via PDF

The attack leverages a previously known PDF flaw to spread malware all over a PC

Security researcher Jeremy Conway says he has discovered a way to spread malicious code across PDF documents on a victim's computer.

The attack leverages a flaw in the way the PDF file format works, adding malicious data to legitimate PDF files that could then be used to attack anyone who opens them.

Conway, a product manager with NitroSecurity, had already developed a technique for injecting the malicious commands into PDFs. But his attack only worked when there was some other malicious program on the system that added the code. That all changed last week, when researcher Didier Stevens showed how a PDF document could be altered to run an executable file on a victim's computer.

"When I saw Didier's hack, it was the first time I could do it from completely inside the PDF," Conway said.

Hackers have known for some time that PDF readers could be manipulated in this way, but Stevens' attack showed how one reader -- Foxit Reader -- could launch the executable without even notifying the user. Foxit has now patched this bug, but the underlying flaw in the PDF standard can't be fixed without changing the PDF standard itself.

"This is an example of powerful functionality relied on by some users that also carries potential risks when used incorrectly," a spokeswoman for Adobe Systems said via e-mail.

Users who want to turn off the Adobe Reader or Acrobat feature that allows the attack to work can click "Edit > Preferences > Categories > Trust Manager > PDF File Attachments" and then un-check the box that reads "Allow opening of non-PDF file attachments with external applications."

With version 3.2.1 of Foxit Reader, released Thursday, the software now pops up a dialogue box asking users if they really want to execute the code. Adobe Reader does the same thing.

In a video demo of his attack, Conway shows how he was able to build a malicious PDF document with the executable code that also inserted his own text in Adobe's warning box. By adding text such as "click 'Open' to unencrypt this file," an attacker can increase his chances of getting a victim to open the file.

If a user falls for the trick and allows the executable to run, Conway's attack then acts like a worm, copying a malicious payload to other PDF files on the computer. This malware can be a known PDF attack or something worse. It "could be the next vector for a 0day attack," Conway said.

He believes most enterprises are unprepared to deal with this technique, should it be adopted by cybercriminals. "Most responders are not going to go through every document on a user's computer to make sure it's safe," he said.

He has not released the code for his attack, just the video showing it in action.

The PDF attack could be used to do things such as inject malicious macros into Word documents, said Thierry Zoller, a security consultant with Verizon Luxembourg, speaking via instant message. "You could also easily infect anything else," he said.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags pdf bugJeremy Conway

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Essentials

James Cook University - Master of Data Science Online Course

Learn more >

Mobile

Exec

Budget

TerraCycle Zero Waste Box Pens and Markers Small

Learn more >

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?