Thread by @seecurity

New Paper: “Practical Decryption exFiltration: Breaking PDF Encryption“ describing new attacks that uncover the plaintext of encrypted PDFs. To be presented at @acm_ccs and joint work with @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk. #PDFex 1/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk Do you remember the efail.de attacks against S/MIME and OpenPGP encrypted emails? It’s basically that but against encrypted PDFs. Paper: pdf-insecurity.org. #PDFex 2/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk The attacker modifies an encrypted PDF and sends it to the receiver. The receiver opens and decrypts the modified PDF and the viewer immediately sends the plaintext of the PDF to the attacker. #PDFex 3/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk As with #efail, there are 2 different versions of #PDFex: dirext exfiltration and CBC gadgets. The first surrounds the ciphertext with an image HTTP URL or a PDF form submitting the decrypted content to the attackers server. #PDFex 4/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk CBC gadgets means that the ciphertext is modified to exfiltrate itself after decryption. #PDFex 5/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk This works because a) the PDF standard allows a mix of plaintext and encrypted content b) it defines no authentication method for encryption (i.e. not MAC) and c) it allows fetching content from and posting content to remote HTTP servers. #PDFex 6/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk As a result, 27/27 PDF viewers were vulnerable (14 without user interaction, 13 with user interaction). #PDFex 7/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk Main mitigations on PDF standard level are: a) remove partial encryption and b) define and enforce authenticated encryption. #PDFex 8/n

@acm_ccs @jensvoid @Murgi @v_mladenov @CheariX @JoergSchwenk Thanks to @certbund for helping with the disclosure! #PDFex 9/9