Shadow Attacks … The Smallest Attack Vector Ever

In July 2020, we introduced a novel attack class called Shadow Attacks. In our recent research, we discovered a new variant of the attack which relies only on an Incremental Update containing a malicious trailer.
A proof-of-concept exploit working on Foxit (Version: 11.0.1.49938) can be downloaded here.

The story so far ...

Shadow attacks are attacks bypassing the integrity protection of digitally signed PDF documents. The attacks abuse two legitimate features in PDF documents which we briefly explain.

Hiding Content

In PDFs, there are multiple techniques to hide content that is not displayed when the document is opened. We, as attackers, usually hide malicious objects without referencing them in the xref section.

Incremental Updates

New content can be appended to a signed PDF document. This is quite dangerous though. The digital signature in PDFs protects a specific range of bytes. Any appended content does not break the signature verification since it is outside this range. As a result, any new Incremental Update does not violate the cryptographic verification of the digital signature. 

But, Incremental Updates are quite dangerous since they may completely change the displayed content of the document. In 2019, we showed different techniques based on Incremental Updates – the Incremental Saving Attacks.
As a countermeasure, most vendors warn if additional content is added after signing the document. BUT … not always!!!

 

There are meaningful use cases where Incremental Updates in digitally signed documents are allowed. For instance, contracts should be signed by multiple parties and each new signature is applied via additional Incremental Update.
Also, PAdES defines Incremental Updates as part of the long-term validation of digitally signed PDFs.
In summary, Incremental Updates are painful from a security perspective. Currently, vendors are trying to estimate whether an Incremental Update is malicious or not by analyzing its content.

Shadow Attacks

Shadow attacks, in general, deceive the PDF applications that an Incremental Update is not malicious. This can be done by providing an Incremental Update with minimal content.
In 2020, we estimated that appending an xref section and a trailer is sufficient to bypass the detection mechanisms of popular applications such as Adobe Reader and Foxit Reader.

Trailer-based Shadow Attack

Three months ago, we tried to reduce the content of the malicious Incremental Update. Our idea was to use only a malicious trailer and still change the content of the entire document when it is opened. Let's see how this can be done. 

The Signer's view on the document

 If a signer gets the document depicted on the left side, he or she sees the content "Sign the document to get a reward".
The document contains a hidden content depicted as red text – the 4 0 obj containing the text "You are fired. Get out immediately" and an xref section pointing to that object. However, the trailer references another xref section, see (1) and (2). Thus, the red text is never shown.
From the signer's perspective, there is no possibility to detect the hidden content by opening and reviewing the document.
As a result, the signer, for example the company director, signs the document.

The Victim's view on the document

We assume that the attacker receives the signed document and manipulates it.
The attacker appends only a trailer that points to the hidden malicious xref section (the red one). When the victim opens the document, the content "You are fired. Get out immediately" is shown.
However, the digital signature validation does not throw any warning since … well … what could go wrong if only a trailer is appended.

 

Honest vs. Malicious Trailer

There are small differences between the honest and the malicious trailer– the byte position of the xref section. Now, the trailer points to the hidden xref section.

trailer
<<
/Size 23
/Prev 18735
/Root 13 0 R
]>>

Honest trailer

trailer
<<
/Size 23
/Prev 19192
/Root 13 0 R
]>>

Malicious trailer

 

 

Impact and Exploit

We successfully applied the new attack on Foxit Reader (Version: 11.0.1.49938). We promptly reported the vulnerability and provided a Proof-of-Concept (PoC) exploit, known as CVE-2021-40326.
Foxit acknowledged the attack and published a security fix with the new version Foxit Reader 11.1.
 

We are not aware of any further implementations vulnerable to this attack.
If you think that your application might be vulnerable to the attack, then just download the exploit and test on your own.
 

Authors of this post

Vladislav Mladenov

Simon Rohlmann

Christian Mainka

Related links

1. New Hacker Tools
2. Hackers Toolbox
3. Pentest Tools Find Subdomains
4. Hacking App
5. Top Pentest Tools
6. Hacking Tools Kit
7. Hacking Tools And Software
8. Pentest Tools Alternative
9. Hacker Tool Kit
10. Pentest Recon Tools
11. Top Pentest Tools
12. Hacking Tools For Windows
13. Pentest Automation Tools
14. Hacker Tools List
15. Bluetooth Hacking Tools Kali
16. Black Hat Hacker Tools
17. Pentest Tools Free
18. Hacker Tools Mac
19. Pentest Tools Bluekeep
20. Ethical Hacker Tools
21. Hack Tool Apk
22. Pentest Tools Apk
23. Hack Tool Apk
24. Github Hacking Tools
25. Hacker Tools Apk Download
26. Ethical Hacker Tools
27. Hack Tools 2019
28. Black Hat Hacker Tools
29. Hacking Tools For Beginners
30. Pentest Tools Github
31. Hack Tool Apk
32. Hacking Tools 2019
33. Hack Apps
34. Pentest Tools List
35. Pentest Tools Port Scanner
36. Hacker Tools For Windows
37. Hacking Tools For Mac
38. Hacker Tools Apk Download
39. Hacker Tools For Ios
40. Hacking Tools Download
41. Hack Tools For Windows
42. Hacking Tools For Kali Linux
43. Hacker Tools Apk Download
44. Pentest Tools Kali Linux
45. Pentest Tools For Android
46. Hacking Tools Pc
47. Nsa Hack Tools
48. Pentest Tools For Android
49. Tools Used For Hacking
50. Hacking Tools Windows 10
51. Hacking Tools For Games
52. How To Make Hacking Tools
53. Tools For Hacker
54. Hack Tools Pc
55. Pentest Tools Review
56. Hack Tools Download
57. Hack Tools Pc
58. Hack Tools For Games
59. Black Hat Hacker Tools
60. Nsa Hack Tools
61. Pentest Tools For Windows
62. Hackrf Tools
63. Game Hacking
64. Hacking Tools Kit
65. Pentest Tools Website
66. Pentest Tools Bluekeep
67. Hacker
68. Hacker Tools Online
69. Pentest Tools Github
70. Black Hat Hacker Tools
71. Pentest Tools Port Scanner
72. Hacking Tools Pc
73. Hack Tool Apk No Root
74. Hack Rom Tools
75. Pentest Tools Github
76. Pentest Tools Github
77. Tools 4 Hack
78. Hacking App
79. Hacking Tools Mac
80. Hacking Tools Mac
81. Tools For Hacker
82. Pentest Tools Kali Linux
83. Hacker Tools For Windows
84. Hacker Tools Free Download
85. Hacking Tools Free Download
86. Hack App
87. Hacking Tools Windows 10
88. Hacking Tools Hardware
89. Hacking Tools For Windows Free Download
90. Hack And Tools
91. Ethical Hacker Tools
92. Pentest Tools Open Source
93. Pentest Tools Website Vulnerability
94. Hacker Tools Apk Download
95. Hacker Techniques Tools And Incident Handling
96. Hacker Tools Free
97. Pentest Tools Github
98. Hack Tools Mac
99. How To Install Pentest Tools In Ubuntu
100. Pentest Tools Free
101. Hack Tools Download
102. Pentest Tools For Mac
103. Nsa Hacker Tools
104. Hacks And Tools
105. Hack Tools For Windows
106. Hacking App
107. What Is Hacking Tools
108. Hacker Tools Hardware
109. Pentest Tools Android
110. Hacking Tools For Mac
111. Hack Tools For Mac
112. Pentest Tools Subdomain
113. Hacking Tools And Software
114. Hacking Tools Github
115. Hacking Tools Mac
116. Hack Tools Github
117. Hack Apps
118. Easy Hack Tools
119. Hacker Tools Windows
120. Pentest Tools Kali Linux
121. Hack Tool Apk No Root
122. Hack Tools
123. Pentest Tools For Mac
124. Nsa Hack Tools
125. Hackrf Tools
126. Best Hacking Tools 2019
127. Pentest Reporting Tools
128. How To Hack
129. Hacking Tools
130. Hacking Tools For Mac
131. Hacker Tools List
132. Pentest Tools List
133. Kik Hack Tools
134. Hacker Tool Kit
135. Growth Hacker Tools
136. Pentest Tools Framework
137. Best Hacking Tools 2020