How to Break PDF Encryption

PDF documents are vulnerable to diode exfiltration attacks due to partial encryption and the use of legacy crypto like unauthenticated CBC. These vulnerabilities can be exploited through gadgets and hyperlinks, allowing for the leakage of plaintext and other sensitive information.

• PDF documents allow for partial encryption, leading to diode exfiltration attacks
• Legacy crypto like unauthenticated CBC is used in PDF documents, making them vulnerable to plaintext leakage
• Gadgets and hyperlinks can be used to exploit these vulnerabilities and leak sensitive information

The presenter demonstrated how a script could be used to automatically extract plaintext from a PDF document using gadgets and hyperlinks. They also discussed the issues with using hyperlinks, such as the short length of gadgets and the random bytes in the URL that can break the link. The presenter also explained how compression can be used to hide plaintext in PDF documents, but it can also make exfiltration more complicated.

PDF is among the most widely used document formats worldwide. To ensure confidentiality, PDF supports document encryption. In this talk, we analyze PDF encryption and show two novel techniques for breaking the confidentiality of encrypted documents. First, we abuse the PDF feature of partially encrypted documents to wrap the encrypted part of the document within attacker-controlled content and therefore, exfiltrate the plaintext once the document is opened by a legitimate user. Second, we abuse a flaw in the PDF encryption specification to arbitrarily manipulate encrypted content. The only requirement is one single block of known plaintext, which we show is fulfilled by design. Our attacks allow the recovery of the entire plaintext of encrypted documents by using exfiltration channels, based on standard compliant PDF properties. We evaluated our attacks on 27 widely used PDF viewers and found all of them to be vulnerable. We responsibly disclosed the vulnerabilities and supported the vendors mitigating the issues.