Beware! Did You Know PDF's Can Carry Dangerous JavaScript Code?

[daddyoh]

Hate to be the bearer of bad news but you might want to read this article:
Complex obfuscated PDF exploit - Security Labs Blog

We all need to do a virus scan on our PDF's before we open them.

This is my fav virus scan tool. You upload your unopened file to this site and it scans it with something like 32 diff scanners and gives you the result:

VirusTotal - Free Online Virus and Malware Scan

I use it for all Zip files & PDF's

[vagabondette]

all of my downloads are automatically scanned by AVG once they're done downloading and if anything wonky comes up I get an error immediately. I also do periodic deep scans of all of my downloads because sometimes new things are added to the scanner and found in older files.

[tj]

You should always scan files - even .gif files etc. can carry viruses. Regarding java script files in pdf's - as a viewer program I do not use Adobe.

Timo

[CDarklock]

I use AVG, and it totally failed to spot a JavaScript exploit that botted my machine a couple weeks ago and completely hosed the explorer.exe file. I had to reinstall the O/S.

There's no good reason for JavaScript in a PDF file any damn way. In Acrobat, go to Edit -> Preferences, select JavaScript on the sidebar, and uncheck the "Enable Acrobat JavaScript" box. Problem solved.

[HeySal]

Originally Posted by CDarklock

I use AVG, and it totally failed to spot a JavaScript exploit that botted my machine a couple weeks ago and completely hosed the explorer.exe file. I had to reinstall the O/S.

There's no good reason for JavaScript in a PDF file any damn way. In Acrobat, go to Edit -> Preferences, select JavaScript on the sidebar, and uncheck the "Enable Acrobat JavaScript" box. Problem solved.

Pick up AVAST - it won't let you near the JS redirects. Best of all - it's free.

[CDarklock]

Originally Posted by HeySal

Pick up AVAST - it won't let you near the JS redirects. Best of all - it's free.

AVG picks it up, too - now. Less than a week after I had the problem, AVG accurately identified the source file during a routine scan. The problem with antivirus is that it's reactive. There's always a period of time between the creation of a virus, and the point where antivirus can detect and remove it. Close off the avenue of attack, and it doesn't matter whether you have a JavaScript virus in your PDF files... it simply won't run.

The really infuriating thing is that when this happened with MS Word, and VB for Office was being used to write these things, everyone was up in arms about how terrible it was to allow executable content in documents.

Adobe does it? Not a peep. If it's the principle that matters, and not some misplaced anger at Microsoft for the abject failure of other software houses to compete effectively, people should be just as mad about JavaScript in their PDF files as they were about VB in their DOC files.

But they're not. Because it never was the principle of the thing.

[MasonRamm]

Thanks for the warning but I too scan any downloaded files
before opening them. Plus I make sure I only download
from reputable places/websites.

[ramone_johnny]

Originally Posted by CDarklock

I use AVG, and it totally failed to spot a JavaScript exploit that botted my machine a couple weeks ago and completely hosed the explorer.exe file. I had to reinstall the O/S.

There's no good reason for JavaScript in a PDF file any damn way. In Acrobat, go to Edit -> Preferences, select JavaScript on the sidebar, and uncheck the "Enable Acrobat JavaScript" box. Problem solved.

Agree 100%

This is why we have seen such a rise in the amount of threads like these below....

Need help clearing I frame hack off my website

I too had to resinstall the OS after experiencing similiar issues. AVG, Malwarebytes and a truck load of others didnt pick it up.

As a precaution and a heads up to everyone - be sure to ALWAYS KEEP ADOBE READER updated with the latest version!

Oh and get serious about your AV - I ended up with a CA product and its been fantastic.

Still got the MS one here on my desk - but meh.

[aboutalhah]

I use Avast too. Didn't know that Pdf could harm though...

Thanks for this,
Franck

Originally Posted by HeySal

Pick up AVAST - it won't let you near the JS redirects. Best of all - it's free.

[sparrow]

this form of attack is getting more and more prevalent its to a point nothing is safe anymore someone will exploit it

[tj]

Originally Posted by CDarklock

I use AVG, and it totally failed to spot a JavaScript exploit that botted my machine a couple weeks ago and completely hosed the explorer.exe file. I had to reinstall the O/S.

There's no good reason for JavaScript in a PDF file any damn way. In Acrobat, go to Edit -> Preferences, select JavaScript on the sidebar, and uncheck the "Enable Acrobat JavaScript" box. Problem solved.

What AVG are you using? The free version? That will not pick it up since it is "only" a crippled version of the full version.

Timo