How to Break PDF Encryption
summary
PDF encryption contains two concrete, working break techniques: PDF X uses PDF’s partial-encryption and form/hyperlink actions to siphon plaintext (demo leaks up to ~250 bytes via DNS before user consent), and malleability gadgets use CBC malleability plus the 12-byte known-permissions block and deflate compression tricks to inject URLs and exfiltrate entire streams. Both attacks are exploitable over the network (HTTP/DNS), were demonstrated against 27 viewers including Adobe, Foxit and Chrome/Opera, and succeed unless viewers adopt authenticated encryption or block unencrypted-to-encrypted object access.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 4:46PDF Encryption
- 6:00Attack Mode
- 8:27PDF Structure
- 10:16PDF Standard
- 11:37PDF Crypt Filters
- 14:32Modifying the Document
- 20:32PDF Encryption History
- 23:00CBC Gadget Attacks
- 26:14Known plaintext
- 35:59Evaluation
- 37:40Fixing
related talks
33mPDF - Mess With The Web
01h 06mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2)
22mEfail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels
40mFinding Secrets in PDF Files
49mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 1/2)
41m1 Trillion Dollar Refund – How To Spoof PDF Signatures
23mBADPDF: Stealing Windows Credentials via PDF Files
48mDiscovering C&C in Malicious PDF with Obfuscation, Encoding and Other Techniques