Practical Decryption exFiltration

Abstract

The Portable Document Format, better known as PDF, is one of the most widely used document formats worldwide, and in order to ensure information confidentiality, this file format supports document encryption. In this paper, we analyze PDF encryption and show two novel techniques for breaking the confidentiality of encrypted documents. First, we abuse the PDF feature of partially encrypted documents to wrap the encrypted part of the document within attacker-controlled content and therefore, exfiltrate the plaintext once the document is opened by a legitimate user. Second, we abuse a flaw in the PDF encryption specification to arbitrarily manipulate encrypted content. The only requirement is that a single block of known plaintext is needed, and we show that this is fulfilled by design. Our attacks allow the recovery of the entire plaintext of encrypted documents by using exfiltration channels which are based on standard compliant PDF properties.We evaluated our attacks on 27 widely used PDF viewers and found all of them to be vulnerable. We responsibly disclosed the vulnerabilities and supported the vendors in fixing the issues. CCS CONCEPTS• Security and privacy → Cryptanalysis and other attacks; Management and querying of encrypted data; Block and stream ciphers; Digital rights management.

A research on PDF protection mechanisms

“…And the advantage of the method this paper mainly talks about includes: (1) This method can hide a large amount of data because it uses the Chinese remainder theorem to segment the data and embed it into different PDF objects. (2) This method does not require the establishment of a key, so it is simple and fast to implement.…”

“…Now the PDF, in files includes a large number of embedded technologies, such as Pretty Good Privacy (PGP), JavaScript, Extensible Markup Language (XML), Hyper Text Mark-up Language (HTML), Simple Object Access Protocol(SOAP), Compression will Encryption, etc. At the same time, however, the security of PDF files has been expanded [1]. An attacker can simply use a browser to bypass the external password restrictions of PDF or can use Optical Character Recognition (OCR) technology to analyze PDF text so that it can be copied and pasted.…”