In July 2020, we introduced a novel attack class called Shadow Attacks. In our recent research, we discovered a new variant of the attack which relies only on an Incremental Update containing a malicious trailer.
A proof-of-concept exploit working on Foxit (Version: 11.0.1.49938) can be downloaded here.
A proof-of-concept exploit working on Foxit (Version: 11.0.1.49938) can be downloaded here.
The story so far ...
Shadow attacks are attacks bypassing the integrity protection of digitally signed PDF documents. The attacks abuse two legitimate features in PDF documents which we briefly explain.
Hiding Content
In PDFs, there are multiple techniques to hide content that is not displayed when the document is opened. We, as attackers, usually hide malicious objects without referencing them in the xref section.
Incremental Updates
New content can be appended to a signed PDF document. This is quite dangerous though. The digital signature in PDFs protects a specific range of bytes. Any appended content does not break the signature verification since it is outside this range. As a result, any new Incremental Update does not violate the cryptographic verification of the digital signature.
But, Incremental Updates are quite dangerous since they may completely change the displayed content of the document. In 2019, we showed different techniques based on Incremental Updates – the Incremental Saving Attacks.
As a countermeasure, most vendors warn if additional content is added after signing the document. BUT … not always!!!
As a countermeasure, most vendors warn if additional content is added after signing the document. BUT … not always!!!
There are meaningful use cases where Incremental Updates in digitally signed documents are allowed. For instance, contracts should be signed by multiple parties and each new signature is applied via additional Incremental Update.
Also, PAdES defines Incremental Updates as part of the long-term validation of digitally signed PDFs.
In summary, Incremental Updates are painful from a security perspective. Currently, vendors are trying to estimate whether an Incremental Update is malicious or not by analyzing its content.
Also, PAdES defines Incremental Updates as part of the long-term validation of digitally signed PDFs.
In summary, Incremental Updates are painful from a security perspective. Currently, vendors are trying to estimate whether an Incremental Update is malicious or not by analyzing its content.
Shadow Attacks
Shadow attacks, in general, deceive the PDF applications that an Incremental Update is not malicious. This can be done by providing an Incremental Update with minimal content.
In 2020, we estimated that appending an xref section and a trailer is sufficient to bypass the detection mechanisms of popular applications such as Adobe Reader and Foxit Reader.
In 2020, we estimated that appending an xref section and a trailer is sufficient to bypass the detection mechanisms of popular applications such as Adobe Reader and Foxit Reader.
Trailer-based Shadow Attack
Three months ago, we tried to reduce the content of the malicious Incremental Update. Our idea was to use only a malicious trailer and still change the content of the entire document when it is opened. Let's see how this can be done.
The Signer's view on the document
If a signer gets the document depicted on the left side, he or she sees the content "Sign the document to get a reward".
The document contains a hidden content depicted as red text – the 4 0 obj containing the text "You are fired. Get out immediately" and an xref section pointing to that object. However, the trailer references another xref section, see (1) and (2). Thus, the red text is never shown.
From the signer's perspective, there is no possibility to detect the hidden content by opening and reviewing the document.
As a result, the signer, for example the company director, signs the document.
The document contains a hidden content depicted as red text – the 4 0 obj containing the text "You are fired. Get out immediately" and an xref section pointing to that object. However, the trailer references another xref section, see (1) and (2). Thus, the red text is never shown.
From the signer's perspective, there is no possibility to detect the hidden content by opening and reviewing the document.
As a result, the signer, for example the company director, signs the document.
The Victim's view on the document
We assume that the attacker receives the signed document and manipulates it.
The attacker appends only a trailer that points to the hidden malicious xref section (the red one). When the victim opens the document, the content "You are fired. Get out immediately" is shown.
However, the digital signature validation does not throw any warning since … well … what could go wrong if only a trailer is appended.
The attacker appends only a trailer that points to the hidden malicious xref section (the red one). When the victim opens the document, the content "You are fired. Get out immediately" is shown.
However, the digital signature validation does not throw any warning since … well … what could go wrong if only a trailer is appended.
Honest vs. Malicious Trailer
There are small differences between the honest and the malicious trailer– the byte position of the xref section. Now, the trailer points to the hidden xref section.
Impact and Exploit
We successfully applied the new attack on Foxit Reader (Version: 11.0.1.49938). We promptly reported the vulnerability and provided a Proof-of-Concept (PoC) exploit, known as CVE-2021-40326.
Foxit acknowledged the attack and published a security fix with the new version Foxit Reader 11.1.
Foxit acknowledged the attack and published a security fix with the new version Foxit Reader 11.1.
We are not aware of any further implementations vulnerable to this attack.
If you think that your application might be vulnerable to the attack, then just download the exploit and test on your own.
If you think that your application might be vulnerable to the attack, then just download the exploit and test on your own.
Authors of this post
Vladislav Mladenov
Simon Rohlmann
Christian Mainka
- Hacker Tools Windows
- Hack And Tools
- Hacker Tools Online
- Pentest Tools Apk
- Hacker Tools For Windows
- Hacker Tools 2019
- Pentest Recon Tools
- Best Pentesting Tools 2018
- Pentest Recon Tools
- Pentest Tools Subdomain
- Pentest Tools Nmap
- Pentest Tools Url Fuzzer
- Hak5 Tools
- Hacking App
- How To Hack
- Hacking Tools Name
- Pentest Box Tools Download
- Hacker Tools Free Download
- Hacker Tools 2019
- Hacker Tools For Pc
- Hacking Tools Windows 10
- Tools For Hacker
- Hacking Tools For Beginners
- Hacker Tools Free
- Hacker Tools Mac
- Pentest Box Tools Download
- Hacking Tools Online
- Pentest Tools Linux
- Hacking Tools Kit
- Hacking Tools Github
- Hacking Tools
- Install Pentest Tools Ubuntu
- Pentest Automation Tools
- Wifi Hacker Tools For Windows
- Hacking Tools Software
- Pentest Tools Online
- Pentest Tools Port Scanner
- Hacking Tools For Windows Free Download
- Hack And Tools
- Pentest Tools Website
- Pentest Tools Windows
- Hack Tools For Ubuntu
- Hacking Tools
- Hacker Tools Free
- Pentest Tools For Mac
- Pentest Tools Bluekeep
- Hack Tools For Ubuntu
- Hacker Tools 2019
- New Hacker Tools
- Hacking Tools For Kali Linux
- Hacking Tools For Beginners
- Hacker Tools Github
- Hacker Tools Software
- Hacking Tools For Beginners
- Hack Tools Pc
- Hacking Tools For Kali Linux
- Hacking App
- Pentest Tools Find Subdomains
- Android Hack Tools Github
- Hacking Tools 2019
- Hacker Tools Apk
- Hack Tools 2019
- Hacking Tools 2019
- Hacking Tools Hardware
- Hacking Apps
- Hacker Tool Kit
- Hackrf Tools
- Hacking Tools Kit
- Nsa Hack Tools
- Easy Hack Tools
- Pentest Tools Url Fuzzer
- Hacking Apps
- New Hacker Tools
- Pentest Tools Bluekeep
- What Is Hacking Tools
- What Are Hacking Tools
- Hacker Tools Linux
- Android Hack Tools Github
- Computer Hacker
- Hacking Tools For Games
- Hacking Tools Software
- Hacking Tools Mac
- Free Pentest Tools For Windows
- Best Pentesting Tools 2018
- New Hack Tools
- Pentest Tools Free
- Pentest Box Tools Download
- Hacking Tools And Software
- Nsa Hack Tools Download
- Hacking Tools For Mac
- Hack Tools For Windows
- Usb Pentest Tools
- Free Pentest Tools For Windows
- Hacker Tools
- Hacking Tools Name
- Hacker Tools Apk
- Hacker Tools Windows
- Hacking Tools Kit
- Pentest Tools Find Subdomains
- Hacking Tools For Windows
- Hack Tools
- Game Hacking
- Hack Tools 2019
- Hacking Tools Mac
- Hack App
- Hackers Toolbox
- Hacks And Tools
- Ethical Hacker Tools
- Github Hacking Tools
- Hacking Tools 2019
- Hacking Tools For Windows Free Download
- Hack Tools Download
- Pentest Tools Open Source
- Hacking Tools Free Download
- Hacking App
- Best Pentesting Tools 2018
- Hak5 Tools
- Hack Tools
- Hacking Tools For Pc
- Hacker Tools For Pc
- Hacker Tools Windows
- Hacking Tools For Beginners
- Hacker Tools Apk Download
- Hacks And Tools
- Hacking Tools For Windows
- Hacker Tools Software
- Pentest Tools Framework
- Pentest Tools For Mac
- Termux Hacking Tools 2019
- Computer Hacker
- Hacker Tools Free
- Hack Tools Pc
- Hacker Tools Apk Download
- Computer Hacker
- Hacker Tools For Windows
- Nsa Hacker Tools
- What Are Hacking Tools
- Hacking Tools Mac
- Hack Tools
- Hacking Tools Mac
- How To Make Hacking Tools
- Pentest Tools Windows
- Hack Tools
- Hackrf Tools
- Hackrf Tools
- Hack Tools For Ubuntu
- Pentest Tools Online
- What Is Hacking Tools
- Pentest Recon Tools
- Hacking Tools Github
- Pentest Tools Website
- Pentest Recon Tools
- Pentest Tools For Windows
- Pentest Tools For Ubuntu
- Hackers Toolbox
- Pentest Tools Alternative
- Hacking Tools Pc
- Best Hacking Tools 2020
- New Hacker Tools
- Usb Pentest Tools
- Pentest Tools Github
- Hacking Tools For Windows 7
- Hack And Tools
- Pentest Tools Apk
