Catégorie: Conférence avec actes
Auteurs: Guillaume Endignoux, Olivier Levillain et Jean-Yves Migeon
Date: mai 2016
Série: PDF

PDF has become a de facto standard for exchanging electronic documents, for visualization as well as for printing. However, it has also become a common delivery channel for malware, and previous work has highlighted features that lead to security issues.

In our work, we focus on the structure of the format, independently from specific features. By methodically testing PDF readers against hand-crafted files, we show that the interpretation of PDF files at the structural level may cause some form of denial of service, or be ambiguous and lead to rendering inconsistencies among readers. We then propose a pragmatic solution by restricting the syntax to avoid common errors, and propose a formal grammar for it. We explain how data consistency can be validated at a finer-grained level using a dedicated type checker. Finally, we assess this approach on a set of real-world files and show that our proposals are realistic.

Publié dans les actes 37. IEEE Security and Privacy Workshops (pages 126 à 139)

Présenté lors de la conférence SPW (LangSec) à San Jose, CA, USA en mai 2016

BibTeX Document Présentation Projet sur GitHub Vidéo de la présentation de Guillaume