File Formats Blog

A week ago, I raised the question of risks in PDF documents. That got me wondering about the risks involved in Launch Actions, so I put together a handmade PDF that contained a Launch Action triggered by viewing a page. If this launch happened unimpeded, it could be a serious security risk, as malware could deliver a one-two punch by first delivering an executable and then getting a PDF reader to launch it.

In the testing I've done so far, all versions of Acrobat Reader which I've tried simply ignore the launch action. The JavaScript setting seems to have no effect. A full version of Acrobat for Mac OS X offered to launch the program I selected, but first put up a warning that asked me whether I wanted to proceed.

However, nothing in the PDF spec requires a warning, so it's possible that some readers will blindly launch whatever is asked for. These may not be common enough for malware creators to consider them worth exploiting. If you're interested in experimenting with it, the file is here. It will merely attempt to launch C:\\WINDOWS\\system32\\cmd.exe, so it's harmless even if the launch goes through.

Labels: PDF

# posted by Gary McGath @ 2:14 PM