Caradoc: a Pragmatic Approach to PDF Parsing and Validation IEEE - PowerPoint PPT Presentation

Caradoc: a Pragmatic Approach to PDF Parsing and Validation IEEE Security & Privacy LangSec Workshop 2016 Guillaume Endignoux Olivier Levillain Jean-Yves Migeon École Polytechnique, France EPFL, Switzerland ANSSI, France Thursday 26 th May, 2016 1 / 29

Portable Document Format ? A commonly used format, but many security issues: 500+ reported vulnerabilities in Adobe Reader 1 (since 1999). Discrepancies between implementations. Syntax facilitates polymorphism 2 (PDF+ZIP, PDF+JPEG, etc.). 1 http://www.cvedetails.com 2 See for example PoC||GTFO 2 / 29

Portable Document Format ? A commonly used format, but many security issues: 500+ reported vulnerabilities in Adobe Reader 1 (since 1999). Discrepancies between implementations. Syntax facilitates polymorphism 2 (PDF+ZIP, PDF+JPEG, etc.). In our work, we aim at verifying PDFs from syntactic level. Two approaches to validate files: Blacklist : does not detect new malware... Whitelist : higher rejection rate, but accepted files are clean. 1 http://www.cvedetails.com 2 See for example PoC||GTFO 2 / 29

Table of contents Syntactic and structural problems: a quick tour 1 2 Caradoc: a pragmatic solution 3 Application to real-world files 3 / 29

PDF syntax 101 A PDF document is made of objects: null booleans: true , false numbers: 123 , -4.56 strings: (foo) names: /bar arrays: [1 2 3] , [(foo) /bar] dictionaries: << /key (value) /foo 123 >> references: 1 0 obj ... endobj and 1 0 R streams: << ... >> stream ... endstream 5 / 29

Structure of a PDF file %PDF-1.7 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj Header 2 0 obj Object << /Type /Pages /Count 1 /Kids [3 0 R] >> endobj Object ... xref 0 6 Reference table 0000000000 65536 f 0000000009 00000 n Trailer 0000000060 00000 n ... End-of-file trailer << /Size 6 /Root 1 0 R >> startxref 428 %%EOF Organization of a simple PDF file. 6 / 29

Structure of a PDF file %PDF-1.7 xref 0 6 Header 0000000000 65536 f 0000000009 00000 n Objects 0000000060 00000 n More complex structures: ... ... Original file trailer << /Size 6 /Root 1 0 R >> Table + trailer #1 incremental updates, startxref 428 End-of-file #1 %%EOF object streams, Objects xref ... 0 3 Incremental 0000000002 65536 f linearization. Table + trailer #2 0000000567 00001 n update 0000000000 00001 f 6 1 End-of-file #2 0000001234 00000 n trailer << /Size 7 /Root 1 1 R /Prev 428 >> startxref 1347 %%EOF Incremental update. 7 / 29

Logical structure of a PDF file Document of 17 pages (about 1000 objects). 8 / 29

Graph organization The graph of objects is organized into sub-structures, especially trees. Page tree. Catalog Root of the page tree Node Page 3 Page 4 Page 1 Page 2 9 / 29

Graph organization The table of contents uses doubly-linked lists. Table of contents. Outline root Catalog Chapter Chapter Chapter Section Section Section 10 / 29

Problematic structure An attacker may write an invalid structure. Invalid table of contents. Outline root Catalog Chapter Chapter Chapter Section Section Section 11 / 29

Demonstration Demonstration: two examples Loop in the outline structure https://github.com/ANSSI-FR/caradoc/blob/master/test_files/negative/outlines/cycle.pdf Polymorphic file https://github.com/ANSSI-FR/caradoc/blob/master/test_files/negative/polymorph/polymorph.pdf These files were reported to software editors. 12 / 29

Demonstration These problems may lead to several attacks: Attacks on the structure (denial of service). Evasion techniques (attacks taking advantage of implementation discrepancies). 13 / 29

Solution proposals Caradoc verifies a document at three levels: File syntax. Objects consistency (type checking). Higher-level verifications (graph, etc.). 15 / 29

Syntax restriction At syntax level, guarantee extraction of objects without ambiguity: Grammar formalization 3 (BNF). Structure restrictions (no updates, no linearization , etc.). Systematic rejection of “corrupted” files. 3 https://github.com/ANSSI-FR/caradoc/tree/master/doc/grammar 16 / 29

Syntax restriction At syntax level, guarantee extraction of objects without ambiguity: Grammar formalization 3 (BNF). Structure restrictions (no updates, no linearization , etc.). Systematic rejection of “corrupted” files. When a conforming reader reads a PDF file with a damaged or missing cross-reference table, it may attempt to rebuild the table by scanning all the objects in the file. — ISO 32000-1:2008, annex C.2 3 https://github.com/ANSSI-FR/caradoc/tree/master/doc/grammar 16 / 29

Type checking At object level: guarantee semantic consistency. For this purpose: type checking algorithm. 17 / 29

Type checking trailer 1 0 obj << /Size 7 << /Type /Catalog /Pages 2 0 R >> /Root 1 0 R endobj /Info 6 0 R >> 6 0 obj << 2 0 obj /Author (G. E.) << /Type /Pages /Count 1 /Kids [3 0 R] >> >> endobj endobj 3 0 obj << 5 0 obj << /Type /Page /Name /F1 /MediaBox [0 0 700 200] /BaseFont /Helvetica /Parent 2 0 R /Type /Font /Contents 4 0 R /Subtype /Type1 /Resources << /Font << /F1 5 0 R >> >> >> endobj >> endobj 4 0 obj << /Length 35 >> stream BT /F1 100 Tf (Hello world !) Tj ET endstream endobj Example on a Hello World file. 18 / 29

Type checking trailer 1 0 obj << /Size 7 << /Type /Catalog /Pages 2 0 R >> /Root 1 0 R endobj /Info 6 0 R >> 6 0 obj << 2 0 obj /Author (G. E.) << /Type /Pages /Count 1 /Kids [3 0 R] >> >> endobj endobj 3 0 obj << 5 0 obj << /Type /Page /Name /F1 /MediaBox [0 0 700 200] /BaseFont /Helvetica /Parent 2 0 R /Type /Font /Contents 4 0 R /Subtype /Type1 /Resources << /Font << /F1 5 0 R >> >> >> endobj >> endobj 4 0 obj << /Length 35 >> stream BT /F1 100 Tf (Hello world !) Tj ET endstream endobj Constraint propagation. 19 / 29

Type checking action page destination annotation resource outline content stream font name tree other Types of a 17-page document. 20 / 29

More complex verifications At a higher level: Verification of tree structures (page tree, outlines, etc.). Other verifications easily integrable in the future (fonts, images, existing analyses, etc.). 21 / 29

Caradoc: a Pragmatic Approach to PDF Parsing and Validation IEEE - PowerPoint PPT Presentation

Caradoc: a Pragmatic Approach to PDF Parsing and Validation IEEE Security & Privacy LangSec Workshop 2016 Guillaume Endignoux Olivier Levillain Jean-Yves Migeon cole Polytechnique, France EPFL, Switzerland ANSSI, France Thursday 26 th

A Pragmatic Approach Towards The Regulation of Botanical Food

A Hierarchal Approach to Validation Experiments in Magnetic Fusion Science Validation

A pragmatic approach to the phenomenon of presupposition conditionalization Amaia Garcia-Odon

Workshop on process validation Session 2: Enhanced approach Kowid Ho Process validation for

Module 4: XML Representation Concepts Parsing and Validation Schemas Munindar P. Singh, CSC

Tuesday 9 th April 2013 Process Validation-Enhanced Approach Continuous Process Verification

Interoperability Now! A pragmatic Approach to Interoperability in Language Technology Sven C.

Pragmatic Agility Pragmatic Agility Presented by: Andy Hunt The Pragmatic Programmers

Redis Cluster a pragmatic approach to distribution All nodes are directly connected with a

Industry 4.0 in Glass Needs a pragmatic approach Presented by: Christian Megret September

CSC 4181 Compiler Construction Parsing 1 1 Outline Top-down v.s. Bottom-up Top-down parsing

Introduction to Bottom-Up Parsing Shift-reduce parsing The LR parsing algorithm

A Three-Layered Approach to Facade Parsing Anelo Martinovi 1 Markus Mathias 1 Julien

Tuesday 9 th April 2013 Process Validation-Enhanced Approach Scale down models Frank Zettl Key

Performance of Scientific Applications Lonnie D. Crosby, R. Glenn Brook, Bhanu Rekapalli,

North Meadows Secondary Plan MUNICIPALITY OF STRATHROY-CARADOC Initial Public Meeting May 15,

PDF in Smalltalk Chris1an Haider Introduc1on PDF is a

This Time Font hunt you down in 4 bytes! FROM KERNEL ESCAPE TO SYSTEM CALC @promised_lu

Graphics Lecture 18 COP 3252 Summer 2017 June 6, 2017 Graphics classes In the original

Cons nstruc ucting g Knowledg dge e Gr Graph ph from Un Unstruc uctur ured d Tex ext

HTML Hyper Text Markup Language HTML 4.0 has strict compliance with XML standard

Statistical graphics with Statistical graphics with ggplot2 ggplot2 Programming for Statistical

Quantitative Text Analysis. Applications to Social Media Research Pablo Barber a London

Sancus: Low-cost trustworthy extensible networked devices with a zero-software Trusted Computing