• tal@lemmy.today
    link
    fedilink
    English
    arrow-up
    27
    ·
    17 hours ago

    I can see it now: “New worm infects PDFs, causes users viewing them to mine Bitcoin.”

    • JeeBaiChow@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      9 hours ago

      This was the thought that entered my head. Kids these days didn’t live through rampant vbscripts running off the onLoad event.

      • yggstyle@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        9 hours ago

        If you view it on your system it’s a vector. Large / complex documents which may parse things with different libraries just happen to have a larger attack surface.

      • viking@infosec.pub
        link
        fedilink
        English
        arrow-up
        7
        arrow-down
        1
        ·
        15 hours ago

        One more reason never to use the official adobe software. SumatraPDF is awesome. Barebones and blazing fast.

        • yggstyle@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          9 hours ago

          Anti adobe is cool - the recommendation is appreciated… but any software can be the target of a document based exploit and may well be susceptible to the same exploit depending on the libraries used. Additionally, smaller software projects can take longer to update as they have less staff working on them. Absolutely support open software and alternatives… Just a word of caution.

          • viking@infosec.pub
            link
            fedilink
            English
            arrow-up
            2
            ·
            6 hours ago

            Yeah it does. Adobe has a lot of active script support, including java script for example, which can be exploited. If a software can’t interpret those scripts at all and simply displays plain text, that means malware won’t be executed.

            And since Adobe Acrobat / Acrobat Reader are the most common pdf viewers out there, they are a natural target for hackers as well.

            • iAmTheTot@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              1
              ·
              14 minutes ago

              Is Acrobat the only pdf reader with active script support? For example, do the common browsers which can also open pdfs not support the same things?