SoylentNews is people
SoylentNews
Researchers break digital signatures for most desktop PDF viewers | ZDNet
A team of academics from the Ruhr-University Bochum in Germany say they've managed to break the digital signing system and create fake signatures on 21 of 22 desktop PDF viewer apps and five out of seven online PDF digital signing services.
[...] The five-person research team has been working since early October 2018 together with experts from Germany's Computer Emergency Response Team (BSI-CERT) to notify impacted services.
The team went public with their findings over the weekend after all affected app makers and commercial companies finished patching their products.
The reason why researchers were willing to wait months so all products would receive fixes is because of the importance of PDF digital signatures.
Digitally signed PDF documents are admissible in court, can be used as legally-binding contracts, can be used to approve financial transactions, can be used for tax filing purposes, and can be used to relay government-approved press releases and announcements.
Having the ability to fake a digital signature on an official PDF document can help threat actors steal large amounts of money or cause chaos inside private companies and public institutions.
(Score: 2) by choose another one on Wednesday February 27 2019, @08:37AM (7 children)
Happily, LibreOffice can be used to verify the signatures.
[It's still vulnerable, more so than Adobe v9 in fact, but you get the warm fuzzy feeling of invulnerability that comes from using FOSS with prejudice...]
(Score: 2, Insightful) by Anonymous Coward on Wednesday February 27 2019, @08:48AM
Being open source, it's also more likely to be fixed in a reasonable amount of time.
(Score: 4, Interesting) by FatPhil on Wednesday February 27 2019, @12:54PM (5 children)
Personally I find the idea of document signing being an intrinsic part of the document format an absurdity, that means you need to implement it for every file type you might need to sign (which is potentially all of them). Why not just have a standalone program that signs *any file*? The programs that you manage individual file types might integrate access to that external program into their user interface, sure, but it should treat it as a black box. One file and one set of credentials in, one signed document out.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by DannyB on Wednesday February 27 2019, @03:32PM (4 children)
Yes. That.
Document signing should be a separate application which does exactly one thing and does it whale.
It should also be a specification that can be implemented by multiple applications on all platforms. Making the standard widely available and able to sign all kinds of files, not just PDF, makes it more suitable for its intended porpoise.
Sort of how tar and gzip work well together but separately are different fish.
The lower I set my standards the more accomplishments I have.
(Score: 2) by FatPhil on Wednesday February 27 2019, @04:38PM (3 children)
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by DannyB on Wednesday February 27 2019, @05:22PM (2 children)
Zip may already be the closest thing to a universal container format.
LibreOffice files are really zip files.
Java executable JAR files / libraries (java equivalent of exe/dll) are actually zip files.
Java WAR and EAR files are zip files.
LibreOffice can export PDF files, and optionally include the original document file into the PDF -- in this case the outer structure is an actual PDF not a zip.
The lower I set my standards the more accomplishments I have.
(Score: 2) by FatPhil on Thursday February 28 2019, @12:01AM (1 child)
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 0) by Anonymous Coward on Thursday February 28 2019, @07:27AM
There are many application formats that use the Open Packaging Conventions besides Microsoft. Another one I've seen is using SQLite files as application file formats, i.e. https://www.sqlite.org/aff_short.html [sqlite.org]. In fact, after discussing it with coworkers about the various alternatives, we are considering either using OPC or SQLite. However, we are still leaning to OPC, given the fact that they have an actual specification and recommendations, rather than just telling people to put them in whatever way makes sense to them (to be fair, there is a sort of suggestion spread around the documentation, but good luck with interoperability).