Practical Decryption exFiltration: Breaking PDF Encryption Jens Müller Fabian Ising Vladislav Mladenov [email protected] [email protected] [email protected] Ruhr University Bochum, Chair for Münster University of Applied Ruhr University Bochum, Chair for Network and Data Security Sciences Network and Data Security Christian Mainka Sebastian Schinzel Jörg Schwenk [email protected] [email protected] [email protected] Ruhr University Bochum, Chair for Münster University of Applied Ruhr University Bochum, Chair for Network and Data Security Sciences Network and Data Security ABSTRACT Home/Trusted Environment The Portable Document Format, better known as PDF, is one of the Decrypted Document 1. Victim opens 2. Exfiltrating Tax Declaration decrypted content most widely used document formats worldwide, and in order to en- an encrypted PDF file Scrooge McDuck with their password via the Internet sure information confidentiality, this file format supports document TOP SECRET Victim encryption. In this paper, we analyze PDF encryption and show Attacker two novel techniques for breaking the confidentiality of encrypted Victim’s PC documents. First, we abuse the PDF feature of partially encrypted documents to wrap the encrypted part of the document within Figure 1: An overview of the attack scenario: The victim attacker-controlled content and therefore, exfiltrate the plaintext opens an encrypted PDF document and unintentionally once the document is opened by a legitimate user. Second, we abuse leaks the decrypted content to an attacker-controlled server. a flaw in the PDF encryption specification to arbitrarily manipulate The encrypted PDF file was manipulated by the attacker be- encrypted content. The only requirement is that a single block of forehand, without having the corresponding password. known plaintext is needed, and we show that this is fulfilled by design. Our attacks allow the recovery of the entire plaintext of en- crypted documents by using exfiltration channels which are based 1 INTRODUCTION on standard compliant PDF properties. The confidentiality of documents can either be protected during We evaluated our attacks on 27 widely used PDF viewers and transport only – here TLS is the method of choice today – or during found all of them to be vulnerable. We responsibly disclosed the transport and storage. To provide this latter functionality, many vulnerabilities and supported the vendors in fixing the issues. document formats offer built-in encryption methods. Prominent examples are Microsoft Office Documents with Rights Manage- CCS CONCEPTS ment Services (RMS) or ePub with Digitial Rights Management • Security and privacy → Cryptanalysis and other attacks; (DRM) (which relies on XML Encryption), and email encryption Management and querying of encrypted data; Block and stream with S/MIME or OpenPGP. Many of those formats are known to ciphers; Digital rights management. be vulnerable to different attacks by targeting the confidentiality and integrity of the information therein [17, 25]. In 2018, the vul- KEYWORDS nerabilities in S/MIME and OpenPGP, today known as EFAIL [38], PDF, encryption, direct exfiltration, CBC malleability, CBC gadgets took attacks on encrypted messages to the next level: by combining the ciphertext malleability property with the loading of external ACM Reference Format: resources (known as exfiltration channels), victims can leak the Jens Müller, Fabian Ising, Vladislav Mladenov, Christian Mainka, Sebas- plaintext to the attacker simply by opening an encrypted email. tian Schinzel, and Jörg Schwenk. 2019. Practical Decryption exFiltration: Breaking PDF Encryption. In 2019 ACM SIGSAC Conference on Computer Complexity of PDF Documents. The Portable Document Format and Communications Security (CCS ’19), November 11–15, 2019, London, (PDF) is more than a simple data format to display content. It has United Kingdom. ACM, New York, NY, USA, 15 pages. https://doi.org/10. many advanced features ranging from cryptography to calculation 1145/3319535.3354214 logic [36], 3D animations [51], JavaScript [1], and form fields53 [ ]. It is possible to update and annotate a PDF file without losing Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed older revisions [54] and to define certain PDF actions52 [ ], such for profit or commercial advantage and that copies bear this notice and the full citation as specifying the page to show when opening the file. The PDF on the first page. Copyrights for components of this work owned by others than the file format even allows the embedding of other data formats such author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission as XML [3], PostScript [32], or Flash [2], which includes all their and/or a fee. Request permissions from [email protected]. strengths, weaknesses, and concerns. All these features open a huge CCS ’19, November 11–15, 2019, London, United Kingdom potential for an attacker. In this paper, we only rely on standard- © 2019 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-6747-9/19/11...$15.00 compliant PDF properties, without using additional features from https://doi.org/10.1145/3319535.3354214 other embedded data formats. PDF Encryption. To guarantee confidentiality, the PDF standard Contributions. The contributions of this paper are: defines PDF-specific encryption functions. This enables the secure • We provide technical insights on how confidentiality is im- transfer and storing of sensitive documents without any further plemented for PDF documents. (section 2) protection mechanisms – a feature used, for example, by the U.S. • We present the first comprehensive analysis on the security Department of Justice [35]. The key management between the of PDF encryption and show how to construct exfiltration sender and recipient may be password based (the recipient must channels by combining PDF standard features. (section 4) know the password used by the sender, or it must be transferred to • We describe two novel attack classes against PDF encryption, him through a secure channel) or public key based (i.e., the sender which abuse vulnerabilities in the current PDF standard and knows the X.509 certificate of the recipient). allow attackers to obtain the plaintext. (section 5) PDF encryption is widely used. Prominent companies like Canon • We evaluate popular PDF viewers and show that all of the and Samsung apply PDF encryption in document scanners to pro- viewers are, indeed, vulnerable to the attacks. (section 6) tect sensitive information [5, 45, 47]. Further providers like IBM • We discuss countermeasures and mitigations for PDF viewer offer PDF encryption services for PDF documents and other data implementations and the PDF specification. (section 7) (e.g., confidential images) by wrapping them into PDF[19, 29, 56, 57]. PDF encryption is also supported in different medical products to 2 BACKGROUND transfer health records [22, 42, 43]. Due to the shortcomings regard- This section deals with the foundations of the Portable Document ing the deployment and usability of S/MIME and OpenPGP email en- Format (PDF). In Figure 2, we give an overview of the PDF document cryption, some organizations use special gateways to automatically structure and summarize the PDF standard for encryption. encrypt email messages as encrypted PDF attachments [8, 28, 34]. The password to decrypt these PDFs can be transmitted over a 2.1 Portable Document Format (PDF) second channel, such as a text message (i.e., SMS). A PDF document consists of four parts: Header, Body, Xref Table, Novel Attacks on PDF Encryption. In this paper, we present the and a Trailer, as depicted in Figure 2. results of a comprehensive and systematic analysis of the PDF en- cryption features. We analyzed the PDF specification for potential Plain PDF Encrypted PDF security-related shortcomings regarding PDF encryption. This anal- %PDF-1.7 Header %PDF-1.7 Header ysis resulted in several findings that can be used to break PDF encryption in active-attacker scenarios. The attack scenario is de- 1 0 obj Catalog 1 0 obj Catalog picted in Figure 1. An attacker gains access to an encrypted PDF /Info (file info) /Info [enc. string] document. Even without knowing the corresponding password, /Pages 2 0 R /Pages 2 0 R they can manipulate parts of the PDF file. More precisely, the PDF 2 0 obj Pages 2 0 obj Pages specification allows the mixing of ciphertexts with plaintexts. In /Kids [3 0 R] /Kids [3 0 R] combination with further PDF features which allow the loading of external resources via HTTP, the attacker can run direct exfiltration 3 0 obj Page 3 0 obj Page Body Body attacks once a victim opens the file. The concept is similar to previ- /Contents 4 0 R /Contents 4 0 R ous work [38] on email end-to-end encryption, but in contrast, our 4 0 obj Contents exfiltration channels rely only on standard-compliant features. 4 0 obj Contents PDF encryption uses the Cipher Block Chaining (CBC) encryp- Confidential content! [encrypted stream] tion mode with no integrity checks, which implies ciphertext mal- 5 0 obj EmbeddedFile 5 0 obj EmbeddedFile leability. This allows us to create self-exfiltrating ciphertext parts content [encrypted stream] using CBC malleability gadgets, as defined in [38]. In contrast to [38], we use this technique not only to modify existing plaintext but to 6 0 obj Encrypt construct entirely new encrypted objects. Additionally, we refined enc. parameters compression-based attacks to adjust them to our attack scenarios. Xref xref Xref xref In summary, we put a considerable amount of engineering effort Table Table trailer into adapting the concepts of [38] to the PDF document format. trailer Trailer /Root 1 0 R Trailer /Root 1 0 R Large-Scale Evaluation. In order to measure the impact of the /Encrypt 6 0 R vulnerabilities in the PDF specification, we analyzed 27 widely used PDF viewers.