hello everyone and welcome to the talk
breaking the specification
pdf certification my name is simon and
this was a joint work with vladislav
christian and york
we are all researchers at whole
university boho
in the next 50 minutes we talk about pdf
certification and how to use features
and certification
to change the content in a certified
document
we start with the basics and take a look
on the pdf structure
incremental updates talk about the
differences between site and certified
documents
and take a look on the permission levels
in certified documents
so on the right side you see a simple
pdf document and each pdf document start
with the header
so the header defines a pdf version
the header is followed by the body and
contains objects of the pdf document
with unique object numbers so it starts
with the object of type catalog
which reference to the pages object
and the pages object reference to all
pages in the document
as you can see there's only one page in
the document so we
only have one object of type
page so the page reference to the
contents of the document or the page
so you see in object number four
there contains a stream and within the
stream
there's the text of the pdf document and
starts with contract
the third part of a pdf document is a
cross reference table
or expert table it
holds the entries or the byte offsets of
the object
defined in the body so as you can see it
starts with one
followed by four this means the
first object is object number one
followed by four entries
so as you can see there's a 10 and 10
means the byte of set 10
so object number one starts at byte
offset 10.
the last part of a pdf document is a
trailer the trailer reference to the
root object
so the root object is of type catalog
and defines a byte offset of the cross
reference table
so in this example the cross reference
table start at byte offset 191
and these four parts build the whole pdf
document
if you want to change the content of a
pdf file
or add new content we do this usually
within an incremental update so this
means only the modification
are added to the end of the pdf file
within an update
but the original pdf content remains
unchanged
so on the left side you see a simple pdf
file and now we want to add
an incremental update we do this by
adding a body update a cross reference
table update and a trailer update
and these three parts build the
incremental update
so if we want to sign a pdf document
we do this within an incremental update
and these incremental update protects
the document
so there's a small part containing the
signature value which leaves unprotected
so if we now want to add an annotation
to a signed pdf document
we do this with another incremental
update
soon as you can see the annotation part
is now unprotected
so let's talk about signed pdf documents
if you want to sign the simple pdf
document
we do this within an incremental update
so as you can
see here we see the revision one is
signed by ceo
but we are not limited to one signature
we can also add another signature
so in update 2 we add the revision 2
which is signed by ceo2
and we also can add annotations but if
we want to add an annotation
like here not for public release we see
there is in the signature part of the
document we see there's an annotation
created with a warning
so signed pdf documents there are
multiple signatures are possible
until assigner explicitly locks the
document and
adding an annotation leads to warnings
but are not blocked
so in certified documents the
certification must be added before
signing the document
this is because the certification sets a
permission level
p1 p2 or p3 for the whole document
so in certified documents up to the
permission level
additional signature our annotations are
allowed
or prohibit so let's take a look on the
difference between signed and
certified documents add or change
visible content is not allowed in a
signed or
certified document but you can fill out
forms
in certified documents p2 or p3
and inside pdf documents this usually
leads to warnings if you do not add a
signature at the same time
but adding multiple signature is also
allowed in site pdfs
and on certified documents at level p2
and p3 adding annotations
leads to warnings the most pdf
application when we do this within sign
pdf but is allowed on a
certified document at level p3 so on the
right side you see a certified document
and a signature was added and an
annotation was added and we see on level
p3
there's no warnings when we add an
annotation
so let's start with the attacks on
certified documents we start with the
evil annotation attack um we use
annotations to add to hide content and
certify documents
and we take a look on the user interface
layers ui layers
and we improve the stealthiness of the
eaa
so for in eaa you need a
certified document on level p3
so adding or changing annotations is
allowed
and annotations can be placed anywhere
in the documents the pdf
specification does not restrict the
position or size of an
annotation so we can add an annotation
as big as we want
and two annotations can overlap each
other
the pdf specification 2.0 defines
26 annotation types and 18 of them
are allowed to be used in a certified
document
so as you can see on the right side we
categorize them by the danger level
so danger level high means you can add
text or images
to the certified document so for
annotation free text and redact you can
add text
and for notation stamp you can images
at the level medium it means you can
hide images or text in a certified
document but you cannot add
new content and on level low you only
can
add icons to the certified documents
so how to use eia to change a content in
a certified document
we first use the annotation type stamp
to hide content with a white image so we
place a white image
above the text we want to change
after this we add a free text comment or
a free text annotation
to add text chosen by the attacker we
place this
over the stamp and now we got
our content placed in the document
as you can see we can add content to a
certified document without
warnings in ui layer 1 which is always
displayed when the document is opened
and no warnings in user layer 2 which
must be opened by the user and provide
more detailed information about the
signature certification
but we have to look at another ui layer
the ui
layer 3 which holds a list of
annotations added to the document
and this layer 3 must be also opened by
the user
but it makes the modifications
detectable for the user
so let's improve the stealthiness of the
array
we first have to find objects of type
anode
you see we have two objects of type
anode here
which hold a value a subtype value of
stamp or free text
so the next step we have to change the
subtype to null or one that is not
specified by the specification
so we set this to null as you can see
and
now the ui layer 3 holds an empty list
so this is how we improve systems of eaa
let's take a look on sneaky signature
attacks
our goal is to use the signature to add
and hide content in a certified document
and we take a look on the structure of
signatures
and on top we show how to improve the
statusness of ssa
the sneaky signature attack is possible
on level p2
and p3 because this level allows to add
a signature to a certified document
and the visible part of the signature
can be placed anywhere in the document
and the pdf specification does not
restrict the position or size of the
signature
and also signature can overlap each
other
on this slide you see the visible part
of a signature
as you can see there is a graphical part
and also a text part
and both parts can chosen by the
attacker
so let's use ssa to change content in a
certified document
we first have to add an empty signature
file over the content to be changed
we can do this manually or using tools
like apache pdf box
which is a java library to modify or
sign pdfs
so in the next step we have to create a
visible signature
with a white background image and text
chosen by the attacker
in the last step we have to insert the
signature to the empty signature files
so now we have placed attacker choosing
content with certified document using
signatures
but this leads to a problem so as you
can see on ui layer 1
and ui layer 2 depending on the pdf
application
the attack is detectable
so let's improve the statusness of ssa
in the first step we have to find the
object of file type sick
so as you can see we find file type 6 in
the object number 7
and object number 7 contains a reference
to the page object
p to the object 3 and
the validation reference to number 8.
the object 8 contains the signature
value
so in the second step we have to change
the reference
of the page object to our own signature
object
this means we change the reference 3
to 7. so in the next step
we have to interrupt the signature
validation and we do this by changing
the referenced v to the next higher
object number so in this case we change
the
value 8 to the value 9.
but this leads to another problem as you
can see
the signature field is now interpreted
as an
empty field so to prevent the signature
field from being interpreted as an
empty field we have to mark it as read
only
and we do this by adding double f1
to the signature object seven
so now the signature field will not be
interpreted as
an empty one so we finished our
improving the stealthiness attack on ssa
so as you can see no signature is here
in ui layer 1
and no signature is on your eye layer 2.
so let's have a look on the evaluation
and the vulnerable pdf
applications we categorized them by the
ui layers
we analyzed 26 pf applications on three
different operating systems
so on the middle part you see the
specification flaws
this means the attacks without improving
the stealthiness
on the right part you see the
application flaws this means the attacks
with improving the statins we categorize
them by the ui layers one two and three
and a full cycle means the attack is
undetectable on the ui layer
a semicycle means the attack is
undetectable on the ui layer but the
general
notification is shown an empty cycle
means the attack is clearly detectable
on the ui layer
as you can see the application flaws
help to increase the number of
vulnerable applications
for example ssa on
ui layer 2 the number of vulnerable
applications increased from 0 to 9
if we improve the stair sinus and
we see the same for eia on ui layer 3
where the vulnerability vulnerable
applications increase
from 0 to 50.
so what is the conclusion and the
lessons learned unprotected updates are
still a big problem in certified
documents and also in signed pdfs
and supposed harmless features like
signatures or annotations
can be used for evil things like adding
content to a certified document
so the specifications should be updated
adding signatures should only be allowed
in a predefined signature
fields defined by the certifier before
the document is certified
and annotation should be limited so
there's no reason
why we can add an image as big as a
whole page or add
content like text to the to the
certified document
using a white list would also help to
reduce implementation flaws
if you want to learn more about pdf
security visit us at pdf
in security.org and on pdf demos.de
we provide for you a detector for ea and
ssa
if you have any questions write us an
email thank you for your attention