16B password breach

The innocents who trust the OS even though the extension is by default hidden. What OS would be stupid enough to do that?

The people don't hide the extension :(

Users do anything these days.

$ curl

But as I understand it, when a government has an "intelligent input box" in their PDF form, one that for example, validates one specific date format, the input box validation is implemented in Javascript. Thus, the "form" box here, could be used as a trigger for the behavior. It could result in Javascript being included. Apparently LibreOffice can export HTML to PDF, and that can include programmatic features.

Summary: PDF has "a lot of crap in it". Beware! This is NOT how PDF started out. The crap came later. it used to be pstopdf and you were done (simple input, simple output).

Paul

The Wiki has info on this too.

Disabling JavaScript execution in the PDF reader can help mitigate such future exploits, although it does not protect against exploits in other parts of the PDF viewing software.

Some security experts say that JavaScript is not essential for a PDF reader and that the security benefit that comes from disabling JavaScript outweighs any compatibility issues caused.[70] "

My Javascript tick box has been cleared, for some years.

As the article mentions, you can also have cases where a PDF is automatically opened by your browser. It may require MIME type action editing, to stop such responses ("Save As" instead of "Open"). The automatic opening of a PDF is an attack surface, mainly as I've never seen a discussion about how good an AV is about recognizing issues with PDF. At least you're not running the web browser as root :-)

Individual applications can have crude malware protection. I found some code in Firefox source, which appears to be stack-smashing protection. Even the application developers are getting into the act.

Paul

It's the default (Hide File Extension).

It's one of the first things I have to fix after an install.

Yes, a small percentage of Windows users know about this, but sometimes you detect that a user hasn't fixed it, because they are asking questions about "files that seemingly don't have an extension" :-)

"How do I open Bill ? This is my folder

Bill Bill "

As a side note, Windows is normally case-insensitive, but you can also switch on case sensitivity. Then this is allowed. Normally, if a Windows user saw this, they'd freak out. Case-insensitive would stop you from doing this, as the second file with that name would claim to be about to overwrite the first one. With case-sensitivity enabled, you can do this.

bill.txt Bill.txt

Paul

They seem to understand their customers pretty well. That's why 2/3rds of computers (as opposed to 'phones) run their stuff.

Andy

My feeling is that so much software is now bloatware - lets add 100 unrelated functions to something that was simple and worked and then wonder why there are so many bugs and vulnerabilities.

There's nothing to stop bill.exe containing its icon that happens to be identical to the Windows PDF file icon...

Some of that comes from code re-use. Much modern software is complex enough that the only way to build it in a sensible time frame is to make use of existing libraries and code bases.

This is mostly good - it saves re-inventing the wheel, and it means you can acquire complex code (e.g. a networking stacks, or device drivers) quickly and have a reasonable expectation that it has been well tested.

On the down side you probably get lots of functionality that you may have no use for - but it still lurks in your code increasing bloat, and attack surface.

I saw some code that had exception handling round a block of code. If it caught an exception, it fed the offending bit of code and the error message to chatgpt, with a request for working code. It then ran an "eval" on whatever it returned!

That comes as a bit of a shock - does that mean that the invoice pro-forma PDFs that I created that use embedded javascript to do all the sums, were just a figment of my imagination?

You can get PDF viewers that do not support or run Javascript in PDF files. I gave up on Adobe PDF Reader years ago due to its massive, bloated footprint and never ending security issues. Worse was any Adobe update was enormous and took forever to run. On top of all of that it would run JS in a PDF making it a real security issue.

I've been using evince on Linux and Windows as my primary PDF viewer for most of the last 10 years. Works the same on Windows and Linux and is immune to most of the Adobe poison and crap. There are some files that don't render for which I use Sumatra PDF.

Ditch Adobe and breathe freely.

This is true, although PDF has been part of the PDF spec for a very long time.

Also worth noting that it is running in a sandbox in the context of the PDF and not on the host platform directly, so is not generally a high risk.

(and remember that PDF was built on top of PostScript - also a fully Turing complete programming language)

Yup, it is a massive lumbering lump, you can't argue.

Foxit reader is not bad either.

No. It means that they were not standard PDFs,

Exactly

Amen

On windows I been using Sumatra for viewing

For Windows, if you want to manipulate PDF files see

endobj

endobj

endobj

endobj

trailer <</Root 1 0 R>>

%%EOF

That's not a complete working example file, but it at least shows how you define a Javascript object (Object #3) inside a PDF file.

You are most likely to see this on a government form. A lot of civilian documents don't have this. On the other hand, travel brochures delivered as PDF are chock-full of landmines.

One form, had a Date Of Birth sanitizer, and it would not allow you to populate the box on the form, with anything except the correct format. Quite frustrating.

You are probably saying at this point, "Hey, my PDF doesn't look like that in Notepad". A command like this may help. It removes the first level of obscurity.

mutool convert -F pdf -O decompress,clean -o OUT.pdf IN.pdf

It is unlikely to render font tables as text. And embedded images will not look "small" or "pretty" afterwards either. But the object structure of the document may be more apparent, after you do such a conversion.

Postscript had no checks at all in its structure. A human could use a text editor and fix all sorts of bugs, and Postscript would not even whimper. (You could, for example, delete the section in PostScript that says DONT DELETE THIS SECTION.) Whereas a PDF has "checksums and counts" to thwart humans.

Paul

Why Microsoft does not correct their choice of default view, I will never know.

My eyesight isn't very good, and I can use any extra hints I can add.

Paul

to use Windows ... and people *do* get caught out by the invoice.pdf.exe trick and the sign-in here to retrieve an encrypted document trick ...