Polymorphic in PDF

While files can be polymorph to escape detection, it is also shown that PDF can be easily polymorphed to escape detection by AV. And the best of this doesn't involve complicated mathematics.

This article was based on:
http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/

OK, lets start with names. After PDF spec 1.2, basically we can encode all the names (which is followed after the "/") using hexadecimals. For example :

We want to open my blog using the /URI name:

/URI (http://nemesisv.blogspot.com)

But AV may be looking for "/URI", we can encode it into hex by doing this:

/#55#52#49

This is all in hex, but to create more choices, we can have :

/U#52I
/#55R#49

and so on. You get the picture. This will allow us to morph the name a bit.

Secondly, we can also morph the strings values. In this case, its the URL. We have several tricks that can be used here.

Firstly, the "escape new line" method:

/URI (http://nemesisv.blogspot.c\
om)
This can be use to break into new lines (for easy reading maybe). Also, just push this further, we can do this:

/URI (http://nem\
esis\
v.blog\
spot\
.com)

or even more extreme, we can break all the characters. Lets see AV write one rule that can detect that. (I am sure multiple rules can do it, but that's the challenge leave for the AV companies)

How about Hexadecimal? Yes, we can do that too:

/URI (687474703a2f2f6e656d65736973762e626c6f6773706f742e636f6d)

Or yes, even with some space :

/URI (687474 703a2f2f6e656d657369 73762e626c6f6773706f74 2e636f 6d)

Now, that's really going to piss the AV detection off. But hexadecimal is not the only thing we can use for encoding the values. We can use octal decimals as well:

/URI (\150\164\164\160\72\57\57\156\145\155\145\163\151\163\166\56\142\154\157\147\163\160\157\164\56\143\157\155)

To finish this off, PDF even suppose anonymous encryption which the user does not need to know the password to operate the PDF. Now, we are really using the other end of the blade back at the AV. So the whole string will look like some rubbish instead.

Of course, some of the above can be effectively mix and match to morph your PDF payload, but it is very unlikely the encryption can be detected by AV. Unless the AV ban all /URI tags, but until then, PDF is ideal for phishing and other very bad things.

The more you patch, the more you (are suppose to fix)...

I try not to sound Adobe bashing, but the recent fix released by Adobe to address some "unknown" vulnerability had just opened up a bigger can of worms.

Read about it:
http://secunia.com/blog/76/

Basically, the fix to put in place for "something" from 9.3 to 9.3.1 of he Adobe Reader had introduced a TIFF library (which Adobe has control over the format). So, maybe we can say that 9.3.1 may be more vulnerable than 9.3 itself.

But, being said that, I would like to stress that 9.3 is currently very exploitable. Why so? There is a friendly metasploit library which targets basically almost all current version here:
http://packetstormsecurity.org/1003-exploits/adobe_libtiff.rb.txt

I am not saying you should give up using PDF and switch over to XPS, but at least use PDF with a cautious mind.

Acrobat and Share Folders Security

I was at a local seminar organized by Adobe. Thanks for the invitation. However, one feature about commenting and approving of PDF was a bit of concern for me. This feature basically allow people (in their example, people from different department such as the technical and the sales etc) to share and comment or approve certain PDF via a common share folder without password.

Tell me what is the first thing in your mind.

.
.
.
.
.

Well, if you are thinking about the problem with a common share folder then BINGO. This is so totally unrealistic (to me) and I pointed that out. But guess what? Adobe answered that this is a COMMON practise and asked the audience how many of them has that in their office and many hands were raised. Although my question was shot down, but now we have a bigger concern here now. How can company even allow a cross-department common share folder to exist? When I audit these company, I am so going to fail them... :)

Imagine finances need to prepae the quarter budget and needs some approving and they use this feature. Miss tom-dick-and-harry from the helpdesk will also have access to this SHARED and NON-PASSWORDED folder. And the budget is in the street in no time. Or if the latest technical details of the company's secret weapon is put up for approval, then before they could finish, their competitor somehow has already completed a prototype based on a "helpful" clerk in the company.

Firstly, in my own opinion, I am so against sharing of unencrypted folders. Then to make it worse, its to be a all-access password-less folder. If proper security is put in place, each department should be having their own passworded folders. Either Adobe has totally think people will not use this feature, or they have totally overlooked security as a design. I don't even want to go into their alternative "approval by email" option.

Acrobat Reader 8 for Vista

Guess what? I uninstalled Acrobat Pro Trial and then I gotten myself PDF Factory (http://www.fineprint.com) and I thought I am pretty over with making PDF. Wrong, I still need the Acrobat PDF Reader. But the lucky news is that when I visited the page, they claim there is a Acrobat Reader 8 for Vista. YES!

NO! Guess what? The same error message appears about permission with temp space. See my previous entry for the details. So, its back to square one. Have to extract the files and run the msi instead again. That got it installed finally.

But wait, run update immediately. Yes, there is already an update now and its not even in the install package.

Anyway, for the detail instructions, see my previous entry.