Mrs. King - School Year 2010-2011

Sunday, January 21, 2024

Shadow Attacks … The Smallest Attack Vector Ever

In July 2020, we introduced a novel attack class called Shadow Attacks. In our recent research, we discovered a new variant of the attack which relies only on an Incremental Update containing a malicious trailer.
A proof-of-concept exploit working on Foxit (Version: 11.0.1.49938) can be downloaded here.

The story so far ...

Shadow attacks are attacks bypassing the integrity protection of digitally signed PDF documents. The attacks abuse two legitimate features in PDF documents which we briefly explain.

Hiding Content

In PDFs, there are multiple techniques to hide content that is not displayed when the document is opened. We, as attackers, usually hide malicious objects without referencing them in the xref section.

Incremental Updates

New content can be appended to a signed PDF document. This is quite dangerous though. The digital signature in PDFs protects a specific range of bytes. Any appended content does not break the signature verification since it is outside this range. As a result, any new Incremental Update does not violate the cryptographic verification of the digital signature. 
But, Incremental Updates are quite dangerous since they may completely change the displayed content of the document. In 2019, we showed different techniques based on Incremental Updates – the Incremental Saving Attacks.
As a countermeasure, most vendors warn if additional content is added after signing the document. BUT … not always!!!
 
There are meaningful use cases where Incremental Updates in digitally signed documents are allowed. For instance, contracts should be signed by multiple parties and each new signature is applied via additional Incremental Update.
Also, PAdES defines Incremental Updates as part of the long-term validation of digitally signed PDFs.
In summary, Incremental Updates are painful from a security perspective. Currently, vendors are trying to estimate whether an Incremental Update is malicious or not by analyzing its content.

Shadow Attacks

Shadow attacks, in general, deceive the PDF applications that an Incremental Update is not malicious. This can be done by providing an Incremental Update with minimal content.
In 2020, we estimated that appending an xref section and a trailer is sufficient to bypass the detection mechanisms of popular applications such as Adobe Reader and Foxit Reader.

Trailer-based Shadow Attack

Three months ago, we tried to reduce the content of the malicious Incremental Update. Our idea was to use only a malicious trailer and still change the content of the entire document when it is opened. Let's see how this can be done. 


The Signer's view on the document

 If a signer gets the document depicted on the left side, he or she sees the content "Sign the document to get a reward".
The document contains a hidden content depicted as red text – the 4 0 obj containing the text "You are fired. Get out immediately" and an xref section pointing to that object. However, the trailer references another xref section, see (1) and (2). Thus, the red text is never shown.
From the signer's perspective, there is no possibility to detect the hidden content by opening and reviewing the document.
As a result, the signer, for example the company director, signs the document.

The Victim's view on the document

We assume that the attacker receives the signed document and manipulates it.
The attacker appends only a trailer that points to the hidden malicious xref section (the red one). When the victim opens the document, the content "You are fired. Get out immediately" is shown.
However, the digital signature validation does not throw any warning since … well … what could go wrong if only a trailer is appended.
 

Honest vs. Malicious Trailer

There are small differences between the honest and the malicious trailer– the byte position of the xref section. Now, the trailer points to the hidden xref section.
trailer
<<
/Size 23
/Prev 18735
/Root 13 0 R
]>>
Honest trailer
trailer
<<
/Size 23
/Prev 19192
/Root 13 0 R
]>>
Malicious trailer
 
 



Impact and Exploit

We successfully applied the new attack on Foxit Reader (Version: 11.0.1.49938). We promptly reported the vulnerability and provided a Proof-of-Concept (PoC) exploit, known as CVE-2021-40326.
Foxit acknowledged the attack and published a security fix with the new version Foxit Reader 11.1.
 
We are not aware of any further implementations vulnerable to this attack.
If you think that your application might be vulnerable to the attack, then just download the exploit and test on your own.
 

Authors of this post

Vladislav Mladenov

Simon Rohlmann

Christian Mainka

Related links
  1. Free Pentest Tools For Windows
  2. Hacker Tools Hardware
  3. Hack Tool Apk
  4. Pentest Tools Linux
  5. Pentest Tools Linux
  6. Hacker Tools Windows
  7. Pentest Tools For Android
  8. World No 1 Hacker Software
  9. Hacker Tools Free
  10. Pentest Tools Kali Linux
  11. Pentest Tools Online
  12. Termux Hacking Tools 2019
  13. Computer Hacker
  14. Pentest Automation Tools
  15. Ethical Hacker Tools
  16. World No 1 Hacker Software
  17. Pentest Tools
  18. Pentest Tools For Mac
  19. Hacking Tools For Mac
  20. Game Hacking
  21. Hacking Tools For Windows
  22. Pentest Tools Alternative
  23. Hacking Tools Hardware
  24. Pentest Tools Bluekeep
  25. Pentest Tools Windows
  26. Best Pentesting Tools 2018
  27. Hack Website Online Tool
  28. Hack Website Online Tool
  29. Usb Pentest Tools
  30. Pentest Tools Website Vulnerability
  31. Hacker Tools List
  32. Github Hacking Tools
  33. Best Pentesting Tools 2018
  34. Hack Website Online Tool
  35. Hacking Tools Name
  36. Hacking Tools For Windows
  37. Hacker Tools Online
  38. Best Hacking Tools 2020
  39. Pentest Tools Review
  40. Pentest Tools Url Fuzzer
  41. Hacking Tools For Windows 7
  42. Hacking Tools For Beginners
  43. Usb Pentest Tools
  44. Hacking Tools And Software
  45. Top Pentest Tools
  46. Hack Tools For Windows
  47. Kik Hack Tools
  48. Android Hack Tools Github
  49. Github Hacking Tools
  50. Hackers Toolbox
  51. New Hack Tools
  52. Github Hacking Tools
  53. Hacking Tools 2019
  54. Pentest Tools Bluekeep
  55. Pentest Recon Tools
  56. Hacking Apps
  57. Hacking Tools Download
  58. Hacker Tools 2019
  59. Hack Tool Apk
  60. Pentest Tools Review
  61. Termux Hacking Tools 2019
  62. Hacks And Tools
  63. Pentest Tools Website
  64. Hack And Tools

Blog Archive