Hacker News Reader

Comment by Run_DOS_Run | Hacker News Reader

I see enough people in companies and privately using Adobe Acrobat. However, given the quality of the software (from Adobe in general) and all the security holes that have been exploited for Acrobat over the years, I can advise everyone not to use Adobe PDF Acrobat Reader and instead open PDF files in Firefox (pdf.js) or Chrome (pdfium).

A look at the PDF specification is enough to know that it is a hard task to parse such a complex file format without memory bugs: the file is read backwards, which is why the x-ref table is at the end of the file, actually PDF is supposed to be exclusively ASCII... except that every PDF contains binary streams and in addition functions and properties which are defined are ignored even by Adobe Reader. I wrote some PDF-fuzzers a few years ago and the whole file format is a huge mess..

View on HN

> can advise everyone not to use Adobe PDF Acrobat Reader and instead open PDF files in Firefox (pdf.js) or Chrome (pdfium).

I agree that Acrobat should be avoided whenever possible but I advise everyone not to use any PDF reader that's found in a browser either because PDF is a minefield and you can expect that the most popular (default) readers will be the most heavily targeted by attackers who will inevitably find security issues. 80% of the time, users are best off downloading PDF files to disk and converting them to text or PNG before opening while resorting to a non-browser/adobe reader for any other cases excepting the ones where you're just forced to use Adobe's software because of some advanced feature.

It won't work for everybody, and it's not as if PDF converters and less common PDF readers are immune from bugs either, but if the vast majority of the time you open a PDF file all you really want is text it can be nice to know your file isn't doing things like making network connections, running JS, playing multimedia or some other bullshit PDF allows for at the same time.

>image

No. If you use Linux, the correct thing to do would be to convert the PDF into DJVU and use djview4 to read it.

Or better to xpm. Just to be sure /s

That sounds good as long as you don't mind lossy compression (which shouldn't matter for text but might for images)

Pdf2djvu (and most ghostscript/poppler/djvu based tools) have quality settings for images.

The advantage of pdf.js/pdfium is they are just web pages themselves. To exploit it you need to not only find a PDF exploit but a browser exploit - at which point it'd be many times easier to just serve the browser exploit via a normal page.

Converting PDFs to text or PNG on the machine just means you're now getting rid of the need for that 2nd level exploit by running something natively on the machine.

I see it as the other way around. Now you only need a single PDF exploit to compromise the browser and in bad cases, a single PDF can compromise the entire system.

Could you explain why a PDF exploit would bypass the need for an exploit that bypasses the web sandbox? As mentioned the pdf engines in browsers are not written in native code, I don’t see any way to bypass the need for both a pdf exploit AND a browser sandbox exploit.

that's nice except that I periodically receive PDFs created by other companies, or even gov. orgs, which I find I am unable to fill out and/or sign using anything other than Acrobat on Windows :/

Reply on news.ycombinator.com