The first two values in it remained unchanged, only the address of the end of the signature code was altered. The researchers attempted to add another /ByteRange field immediately after the signature. Naturally, the signature cannot sign itself, so the area where it is stored is excluded from the process of signature calculation. In the latter are four parameters - defining the start of the file, the number of bytes before the signature code, a byte determining where the signature code ends, and the number of bytes after the signature - because the digital signature is a sequence of characters generated by cryptographic means from the code of the PDF document. Signing a document adds two important fields as an incremental update to the body: /Contents, which contains the signature, and /ByteRange, which describes exactly what was signed. In the other five cases, to reveal any sign of manipulation, the user had to enter the menu and check the validity of the digital signature manually simply opening the file was insufficient. What’s more, six of them showed absolutely no signs that the document opened for viewing had been modified. In total, 11 of the 22 PDF viewers proved vulnerable to these simple manipulations. Two more viewers fell for it - Foxit and MasterPDF. Next, the researchers wondered what would happen if they simply copied the digital signature into their own “manual” update. Three others swallowed the file without any objection. Two PDF viewers saw that the sections were missing and automatically added them without notifying the reader about a change in content. Some applications refused to work with such a file. The next experiment involved removing the two final sections (that is, adding an update to the body, but not the new Xref and trailer). Worse, one of the PDF viewers (LibreOffice) did not even show the message. Not the most enlightening message, especially not for an inexperienced user. When a user opens a file that’s been modified in this way, the PDF reader usually displays a message saying that the digital signature is valid but the document has been modified. Strictly speaking, that’s not an attack - the team simply used a function implemented by the creators of the format. Incremental saving attack (ISA)įirst, the team tried to add extra sections to the file with another incremental update using a text editor. In essence, a digital signature is also an incremental update, adding another element and corresponding sections to the file. That effectively makes it possible to change how the objects are seen by the user, and to add new content. From a technical point of view, the function adds three more sections: updates for the body, a new Xref directory, and a new trailer. Integrated in the format is an incremental update function that allows the user to, for example, highlight part of the text and leave comments. The trailer contains two important parameters that tell the program where to start processing the file, and where the Xref section begins. Each file consists of four main parts: the header, which shows the PDF version the body, which shows the main content seen by the user the Xref section, a directory listing the objects inside the body and their locations (for displaying the content) and the trailer, with which PDF viewers start to read the document. PDF file structureįirst, a few words about the PDF format. The team selected 22 popular PDF viewers for various platforms, and systematically fed them the results of their experiments. After all, clients who receive a signed document from a bank are likely to trust it and click on any links in it. In theory, cybercriminals could do the same to impart false information or add malicious content to a signed file. The researchers’ task was simple: Modify the contents of a signed PDF document without invalidating the signature in the process. Vladislav Mladenov from Ruhr-Universität Bochum shared the team’s findings at the Chaos Communication Congress (36С3). So, a team of researchers from several German universities set out to test the robustness of PDF signatures. When you open a signed file in any PDF viewer, the program displays a flag indicating that the document is signed, and by whom, and gives you access to the signature validation menu. And they often use digital signatures to ensure the authenticity of such documents. Hardly a company or government agency exists that does not use PDF files.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |