New 'Shadow Attack' can replace content in digitally signed PDF files

[Ringel05]

Okay, this one has some potentially VERY serious ramifications.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.
Because the layer was included in the original document that the victim signed, changing the layer's visibility doesn't break the cryptographic signature and allows the attacker to use the legally-binding document for nefarious actions -- such as replacing the payment recipient or sum in a PDF payment order or altering contract clauses.

New 'Shadow Attack' can replace content in digitally signed PDF files | ZDNet

 

[White 6]

Okay, this one has some potentially VERY serious ramifications.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.
Because the layer was included in the original document that the victim signed, changing the layer's visibility doesn't break the cryptographic signature and allows the attacker to use the legally-binding document for nefarious actions -- such as replacing the payment recipient or sum in a PDF payment order or altering contract clauses.

New 'Shadow Attack' can replace content in digitally signed PDF files | ZDNet

Like a dumb ass, I thought PDF and digital signatures were kind of a gold standard of can not be changed unless you originated the file. Glad I don't do much business with contracts any more, since retirement.

 

[shockedcanadian]

Okay, this one has some potentially VERY serious ramifications.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.
Because the layer was included in the original document that the victim signed, changing the layer's visibility doesn't break the cryptographic signature and allows the attacker to use the legally-binding document for nefarious actions -- such as replacing the payment recipient or sum in a PDF payment order or altering contract clauses.

New 'Shadow Attack' can replace content in digitally signed PDF files | ZDNet

What about the original .pdf that was signed and which the end user sees? If they download the .pdf, does it ensure it is the original that he signed?

None of this surprises me to be honest. The beauty is also the danger in technology, it is always changing, and the good guys will never be able to keep up with the bad guys. Businesses who offer these services will have to improve their security and reliability, , or they will go out of business.

 

[Ringel05]

Okay, this one has some potentially VERY serious ramifications.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.
Because the layer was included in the original document that the victim signed, changing the layer's visibility doesn't break the cryptographic signature and allows the attacker to use the legally-binding document for nefarious actions -- such as replacing the payment recipient or sum in a PDF payment order or altering contract clauses.

New 'Shadow Attack' can replace content in digitally signed PDF files | ZDNet

What about the original .pdf that was signed and which the end user sees? If they download the .pdf, does it ensure it is the original that he signed?

None of this surprises me to be honest. The beauty is also the danger in technology, it is always changing, and the good guys will never be able to keep up with the bad guys. Businesses who offer these services will have to improve their security and reliability, , or they will go out of business.

I have no idea.

 

[Picaro]

My blocks and security settings found a version of nemucod in a file today, imbedded in a counter from Wayback Machine; I downloaded a html page giving the history of the Lake Shore and Michigan Southern. It changes pdf file extensions and the like, but I haven't found any bad one yet, so it didn't have time or my settings prevented it from doing anything. Probably yet another virus written by demented Linux cultists in The Great Windows Jihad.

 

[Darkwind]

Okay, this one has some potentially VERY serious ramifications.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.
Because the layer was included in the original document that the victim signed, changing the layer's visibility doesn't break the cryptographic signature and allows the attacker to use the legally-binding document for nefarious actions -- such as replacing the payment recipient or sum in a PDF payment order or altering contract clauses.

New 'Shadow Attack' can replace content in digitally signed PDF files | ZDNet

Is this in association with 'shopping cart' generated PDF receipts?

 

[Picaro]

Why do morons keep do their banking and using their debit and credit cards online these days? A fricking gift card is cheaper, and limits the losses if it gets hacked. Some go for $2.95. Payiing $5 for a $500 gift card is 1%.

 

[Ringel05]

Okay, this one has some potentially VERY serious ramifications.

The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.
A Shadow Attack is when a threat actor prepares a document with different layers and sends it to a victim. The victim digitally signs the document with a benign layer on top, but when the attacker receives it, they change the visible layer to another one.
Because the layer was included in the original document that the victim signed, changing the layer's visibility doesn't break the cryptographic signature and allows the attacker to use the legally-binding document for nefarious actions -- such as replacing the payment recipient or sum in a PDF payment order or altering contract clauses.

New 'Shadow Attack' can replace content in digitally signed PDF files | ZDNet

Is this in association with 'shopping cart' generated PDF receipts?

Don't know.