alt Hacker NewsPDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.
Replies
> PDFs are executables, that's why it's hard.
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
> PDFs are executables, that's why it's hard. They support running code
I don't think Apple's PDF renderer supports e.g. running JS, you'd need real Acrobat for that. Or are you talking about something else?
> they support decoding images which themselves have their own custom compressors that are also basically code themselves.
But this is fundamentally true for anything that displays images, right? Or are the PDF formats particularly bad for some reason?
From the standpoint of a layman it looks like there's a lot of overlap between writing safe web browsers/engines and writing safe PDF readers/engines. There just hasn't been anywhere near as much of an impetus to push PDF readers/engines in that direction because most of us aren't interacting with PDFs nearly as often as we interact with the web (and things built on web tech).
Willing to bet that a default "treat PDFs/documents/spreadsheets as dumb" option in operating systems would eliminate the majority of common one-click vulnerabilies out there. And exactly 0.001% of actual use cases would be affected.