Breaking PDF Encryption and PDF Signatures by Fabian Ising & Vladislav Mladenov #36c3 
What signed and encrypted PDFs look like. They will be discussing how encryption in PDF files can be broken. First PDF version was released in 1993 and PDF 2.0 was introduced in 2017. #36c3
File structure of PDF files, important for understanding how to break it. #36c3
During the signing of a PDF, an incremental update is done to the PDF which is allowed by updating the body. Once this is complete, the file shouldn't be able to be changed, however this is not the case. #36c3
First attack is the incremental saving attack which enables content addition or removal and the signature remains valid. #36c3
By removing the Xref table and Trailer during the addition of content, No warning was thrown. By manipulating the Xref table and trailer, they could manipulate documents without warning. #36c3
Next is signature wrapping attack: To achieve this, the signature value needs to be excluded from the byte range at the beginning of the file. This can be done by defining another byte range with the signature. #36c3
17 of the 22 PDF Viewers are vulnerable to signature wrapping attacks. #36c3
Next is Universal Signature Forgery attacks where signature validation is disabled but show that the PDF is validly signed. A simple flaw in Adobe Reader led to the bypass of some of the protections. Only 4 apps are vulnerable against signature forgery. #36c3
Next up is PDF Encryption where AES is used with CBC and no use of MAC checking (i.e. no integrity). #36c3
Who uses PDF Encryption? Banks, Governments and other organizations that need to share sensitive data in PDF files since it is the de-facto standard for sharing data. #36c3
PDF Encryption in a nutshell: Document structure is unencrypted, only string and streams are encrypted. This reveals a lot of information which the attacker shouldn't know. #36c3
PDFs can be partially encrypted where some content is encrypted and other content is not encrypted. The team found 18 different techniques on how to break PDF encryption. #36c3
By abusing the submit form action that is supported in the PDF format, you can exfiltrate data out of a PDF file. #36c3
Let's attack the crypto now, by using XOR with a piece of known plaintext, hyperlinks can be identified to be exfiltrated. #36c3
Depending on the permissions of PDFs, the plaintext itself can be used in an attack. The permissions were encrypted to prevent tampering but the plaintext is known due to the structure of the key. #36c3
Most of the PDF viewers fell to one of these attacks which is a real cause of concern. #36c3
Lessons learnt from the research that has been done. #36c3
