The Security Shoggoth: Detecting Malicious PDFs

Thursday, May 21, 2009

Detecting Malicious PDFs

Last night at the NE Ohio Information Security Forum I gave a presentation on Detecting Malicious PDFs. I'm still not sure if I'm going to release the presentation, but I am going to release a Snort signature that I've found useful for detecting evil PDFs.

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"Potential Malicious PDF (OpenAction JavaScript)"; flow:from_server,established; content:"%PDF-"; content:"<</OpenAction <</JS"; within:128; nocase; classtype:trojan-activity;)

This signature looks for the PDF header (indicating we're dealing with a PDF) then an /OpenAction followed by /JS. This indicates that JavaScript will be executed as soon as the document is open.

Yes, I realize this signature can be easily bypassed with PDF obfuscation. However, I've found that attackers are not yet using this very much. Let me know if this is useful to you.

1 comment:

Didier Stevens said...: I recommend you drop the << from the scan: /OpenAction /JS
<< indicates the start of the dictionary, and keys inside the dictionary can appear in random order.

And to increase the probability the snort rule only triggers for PDF documents, add %%EOF too.; May 23, 2009 at 6:26 AM