Shadow attacks let hackers replace content in digitally signed PDF | SC Media
Strategy, Threat intelligence

Shadow attacks let hackers replace content in digitally signed PDF

February 23, 2021
Researchers from Ruhr-University Bochum in Germany have unveiled a new attack class that could enable the bypassing of security countermeasures in digitally signed PDF documents and utilizes the “enormous flexibility provided by the PDF specification so that shadow documents remain standard-compliant,” according to The Hacker News. The method of the attack involves the threat actor creating a PDF document containing content that the party signing the document expects to see plus a piece of concealed content that becomes visible after the PDF is signed. “The signers of the PDF receive the document, review it, and sign it. The attackers use the signed document, modify it slightly, and send it to the victims. After opening the signed PDF, the victims check whether the digital signature was successfully verified. However, the victims see different content than the signers,” the researchers explained. The researchers said they tested 29 PDF viewers and found 16 – including Adobe Acrobat, Perfect PDF, Okular and Foxit Reader – that were vulnerable to shadow attacks.
Jill Aitoro

SC Media Editor in Chief Jill Aitoro has 20 years of experience editing and reporting on technology, business and policy. She also serves as editorial director at SC Media’s parent company, CyberRisk Alliance. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media’s VARBusiness and CRN and Penton Media’s iSeries News.

prestitial ad