Another Proof of Concept
Posted by jeremy on April 6th, 2010
Just a few minutes ago I learned via a comment submitted on my “Are PDFs Worm-Able?” posting that another proof of concept was created performing the same style of attack. Have a look for yourself:
As you can see YunSoul demonstrates this attack can be conducted on multiple PDF files, just as I claimed. I provided no help and/or guidance to YunSoul and this was the first interaction I had with him, so it clearly demonstrates how easy this attack is to pull off and how likely it is that we will soon see malicious code writers taking advantage of this creative use of the PDF specification. YunSoul also has a blog posting regarding his proof of concept here: PDF. I couldn’t get google translate to translate the blog posting, so I don’t know what the specifics are. If I have time I will try to read it later with another translator service.
Another point I would like to make is that these hacks do not require the Launch action to work, as any application or program that has write access permissions could be utilized to perform the misuse of the incremental update feature in a PDF. The reason I chose to use the Launch action is I figured it was a nice compliment to Didier’s original proof of concept. I wrote a little more about another use case that could utilize the incremental update feature in a malicious way here: Clarifying and Dealing with the Recent PDF Hackery.
April 7th, 2010 at 11:03 am
[...] [...]
April 8th, 2010 at 2:01 pm
[...] on from Didier’s blog other researchers (Jeremy Conway and YunSoul [Note: Bablefish translation Korean to [...]
April 8th, 2010 at 11:37 pm
[...] on from Didier’s blog other researchers (Jeremy Conway and YunSoul [Note: Bablefish translation Korean to English]) have shown how to use this [...]
April 13th, 2010 at 12:52 pm
We (Intrepidus Group) released a PoC for embedding an executable in PDFs today: http://intrepidusgroup.com/insight/2010/04/an-executable-wolf-in-a-pdf-sheeps-clothing/.
April 23rd, 2010 at 4:49 pm
[...] on from Didier’s blog other researchers (Jeremy Conway and YunSoul [Note: Bablefish translation Korean to English]) have shown how to use this [...]
April 27th, 2010 at 7:28 pm
[...] A pochi minuti fa ho appreso tramite un commento presentato il mio "sono in formato PDF Worm-Able?" Distacco che un altro proof of concept è stato creato eseguendo lo stesso stile di attacco. Date un'occhiata voi stessi: Come si può vedere YunSoul illustra questo attacco può essere condotto su più file PDF, così come mi ha sostenuto. Ho fornito [. . . ] URL articolo originale http://www.sudosecure.net/archives/653 [...]
May 3rd, 2010 at 8:38 am
[...] View full post on sudosecure.net [...]
May 11th, 2010 at 12:12 pm
[...] on from Didier’s blog other researchers (Jeremy Conway and YunSoul [Note: Bablefish translation Korean to English]) have shown how to use this [...]