Security News > 2021 > May > PDF Feature ‘Certified’ Widely Vulnerable to Attack

Certified portable document format files are used to securely sign agreements between two parties while keeping the contents' integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.

Researchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature.

Unsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, "Evil Annotation" and "Sneaky Signature".

The report also lists the specific certified PDF security flaws found in each application.

"Signature fields must be set up at defined locations in the PDF document before the document is certified," the report explained.

The flexibility offered by Certified signatures presents a massive, potentially catastrophic, security risk for many organizations and the report urges PDF applications to work quickly to come up with wide-scale fixes.

News URL

https://threatpost.com/pdf-certified-widely-vulnerable-to-attack/166505/