PDF security: Broken as designed

Security sure was simpler when I was a wee lad. There was code (computer programs than executed in the CPU), and there was data (static information that was used by the program, but that did nothing by itself). Text files are data - easy to understand right?

Not always. Take PDF, Adobe's Portable Document Format, the most commonly used method to make printable and viewable documents. This is a good example, Installing Ubuntu Linux For Beginners. So riddle me this - is it data, or code?

It looks like we all have to treat it like code, because it could (in theory) download and install arbitrary software, including malware. I don't think that this particular document does, but there's no easy way to tell.

So why, I hear you ask, is there such a huge, gaping, ugly security hole in PDF? Because Adobe put it there on purpose:

Adobe's PDF Reader gets lots of criticism for poor security. However, the problems go beyond one specific PDF reader brand.

Have you ever looked at the specifications for the PDF file format? You can download them from here (PDF). They're 756 pages long. For real.

There's some crazy stuff in the PDF specs.

...

You can embed movies and songs. Into a PDF file. What?

...

PDF files can contain 3D objects, complete with embedded JavaScript? Who comes up with these things?

...

PDFs can have forms. That's fine. But why do we need functionality where such forms can submit the data you input directly to a server somewhere on the net?

It goes on and on. Security FAIL. Fail fail fail fail fail. And now for the punchline: it's wormable, meaning you can use it to build self-replicating malware that spreads from computer to computer:

I have received several email questions and explanation requests regarding my blog post “Are PDFs Worm-Able” and the proof of concept video within the post. Instead of repeating a post I wrote over on my company’s blog I figured I would just link to it from here: Implications of Recent PDF /Launch Hacks. In the linked blog post I describe some of the implications of this style of hack and I also walk through a scenario in which a variation of my proof of concept is utilized to infect all PDFs found on a users system. I don’t think my proof of concept was as clear as I would have liked it to be. Within the proof of concept I infected a single benign PDF file from another PDF file, but this proof of concept could easily be modified to recursively traverse a users computer directories to find and infect all PDF files on that users computer and/or accessible to that user at the time of execution with any payload of my choosing.

Great. Adobe is considering changing the spec, which will do precisely nothing, because there are a Billion computers all attached to the Internet who are just fine with the current spec. A billion computers, broken as designed.

{Sigh}

I tend not to post on security topics where it doesn't effect you or where there's nothing you can do to protect yourself. This is an exception to the rule. It doesn't help to tell you "be careful about software you download" - you're not downloading software.

It may not be possible to patch holes like this. Everyone's sick of me saying it, but your best bet is to run MacIntosh or even better, Ubuntu. People writing exploit code will probably target Windows, and so while it's not a panacea, you have fewer people gunning for you.

More here, in a post from the Pleistocene Age of this blog, when I'd only been posting a couple of months.