IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [pdf]

Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.

163 questions
161
votes
14 answers

What is the safest way to deal with loads of incoming PDF files, some of which could potentially be malicious?

As an investigative journalist I receive each day dozens of messages, many of which contain PDF documents. But I'm worried about some of the potentially malicious consequences of blindly opening them and getting my computer compromised. In the past,…
Tom the journalist
  • 1,289
  • 2
  • 8
  • 9
85
votes
3 answers

Can a PDF file contain a virus?

Could a PDF file contain any type of malware?
user45139
71
votes
3 answers

What security scheme is used by PDF password encryption, and why is it so weak?

Many PDFs are distributed as encrypted PDFs to lock out some of their functionality (eg printing, writing, copying). However, PDF cracking software is available online, which usually cracks the PDF passwords in less than 1 second. It doesn't make…
March Ho
  • 1,675
  • 1
  • 12
  • 15
56
votes
11 answers

How to safely view a malicious PDF?

I have a PDF with important information that may contain malware. What would be the best way to view it?
user11101
45
votes
5 answers

How to scan a PDF for malware?

Can anyone suggest an automated tool to scan a PDF file to determine whether it might contain malware or other "bad stuff"? Or, alternatively, assigns a risk level to the PDF? I would prefer a free tool. It must be suitable for programmatic use,…
D.W.
  • 98,420
  • 30
  • 267
  • 572
22
votes
4 answers

Detecting and preventing 'phone home' behavior in PDF files

I have received several PDF documents via email from someone I do not trust. I need to read the documents and respond to them. They are not encrypted. I want to make sure the documents are completely safe. I scanned them with multiple antivirus…
Tim
  • 221
  • 2
  • 3
20
votes
3 answers

How can I tell if a PDF file I was sent contains malware?

I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How can I tell if it contains code that would allow…
user158844
  • 303
  • 1
  • 2
  • 5
19
votes
1 answer

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords is extracting this hash and bruteforcing it, for…
Sopalajo de Arrierez
  • 641
  • 2
  • 7
  • 16
19
votes
2 answers

How to know if a PDF file is infected?

I'm afraid to open a PDF book. When checking the file via pdfid, I get this: PDF Header:% PDF-1.6 obj 4175 endobj 4174 stream 3379 endstream 3379 xref 0 trailer 0 startxref 1 / Page 794 / Encrypt 0 / ObjStm 6 / JS 3 …
stackflow
  • 305
  • 1
  • 2
  • 9
19
votes
2 answers

Effectiveness of flattening a PDF to remove malware

I'm currently looking at ways to prevent malicious PDF files at the network boundary. This will include virus scanning - but there are known limitations to that. I see a common approach is to flatten the PDF file using something like: gs -dNOPAUSE…
symcbean
  • 18,278
  • 39
  • 73
16
votes
1 answer

Malicious PDF Analysis

I have been analyzing a PDF I suspect to contain malicious content. For the most part, I've always trusted automated tools to determine if a PDF was safe to open. However, my eyes have been opened to all the encryption and obfuscation techniques in…
Ccorock
  • 263
  • 1
  • 6
16
votes
2 answers

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present in the embed code. Inspecting the page source of a…
ccpizza
  • 291
  • 2
  • 8
15
votes
8 answers

Document security - how to find who's leaked a confidential document?

I am legally obliged to distribute a document (probably by email, probably saved as MS word, or a PDF) to several hundred recipients. The recipients are legally obliged to keep it confidential. However, based on past experience I'm pretty sure it's…
ConanTheGerbil
  • 251
  • 1
  • 4
13
votes
1 answer

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be exploited by certain byte sequences within the…
RockPaperLz- Mask it or Casket
  • 3,114
  • 21
  • 50
11
votes
3 answers

Can you directly view a malicious PDF on Linux?

There have been questions on safe viewing of malicious PDFs on OS. I would like to know if it's okay to directly open them to view them in a Linux OS because the OS is said to be secure and malware-proof most of the times. I am working on a project…
BlackSwan
  • 213
  • 2
  • 7
1
2 3
…
10 11