Hacker News Reader

Comment by paxy | Hacker News Reader

Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.

View on HN

This is one of the things iOS's Lockdown Mode does. I wish the features of Lockdown Mode were able to be enabled individually instead of a single all or none option.

https://support.apple.com/en-us/105120

Your link doesn’t say anything about PDFs. And if I remember correctly it only disables PDF previews in Messages. This means if you have a zero-click exploit now it becomes a one-click exploit. I fail to see how that’s relevant given the article is already demonstrating a one-click exploit.

I’ve turned on lockdown mode while this CVE insanity is going on. It’s far less disruptive than I expected. The only thing I noticed missing is web gl is disabled.

PDFs are just absurdly complicated in general. Dumbing down the parser might be the right idea. I wonder what consequences that would have with how intertwined PostScript and PDF in general are with macOS/iOS; maybe that's why the PostScript engine was removed with macOS Sonoma/iOS 17? I don't know if that was only user facing behavior and Apple is still working to remove the internal usages.

No. Very few PDF exploits come from the officially sanctioned way of running code (JavaScript) inside PDF. Most are just plain old parser bugs.

That's kind of what Adobe does with downloaded PDFs, you have to click the Enable button to turn on more document features. My schematic capture app will output a PDF that has links that will take you to specific spots on a page and also some JavaScript where you can right click on a part and see it's BOM information. None of that stuff works until you click the Enable button. I've also seen some vendors offer not only normal 3D model files and 2D drawings but a PDF that has an interactive 3D model inside. It's kinda cool how much random shit can go into a PDF but it's clearly a massive malware vector.

One neat thing I've seen is a PDF that will ping an IP catcher when opened in Adobe, regardless of the security level. The same can be done with word docs, excel spreadsheets, and even SVGs.

Did we do that with Excel spreadsheets so that macros are disabled by default?

"dumb" isn't a real thing in computer science though. You mean render them to bitmaps in a sandbox?

I read it more as "don't implement JS, 3D object rendering, slideshow transitions, sound annotations and the other 999 insane features that I'm not even aware exist"

Would require defining what features are needed. "Require PDF/A" is probably a reasonable approximation, though it would break most PDFs

I think he just means disable any of the "advanced" features mentioned above like accessing web content, running custom scripts, etc etc. You might still be vulnerable to any dependencies they use for image rendering itself but I bet it would make it drastically more safe.

Then just have a button for turning those on as needed on a case by case basis

If you disable features then people will see important documents as white rectangles and complain and you'll get a reputation as not working.

"It's for security, honey."

"Okay. If you aren't going to sign this rental agreement, you have five minutes to move your stuff out of my house."

Reply on news.ycombinator.com