Sneaky PDF will be featured at DEFCON 19

\0/, My paper on Sneaky PDF is accepted for DEFCON 19. I'll present on how in-the-wild malicious PDF implementing their obfuscation to avoid for detection and making analysis harder. Here is my full abstract:

Sneaky PDF

Being a most prevalent document exchange format on the Internet, Portable Document Format (PDF) is in danger of becoming the main target for client-side attack. With estimation of more than 1.5 million line of code and loaded with huge functionalities, this powerful document format is suffered with several high impact vulnerabilities, allowing attackers to exploit and use it as malware spreading vector.

Until now, there are thousands of malicious PDF file spreads with little chances of getting detected.

The challenges are obfuscation techniques used by the attackers to hide their malicious activities, hence minimizing detection rate. In order to sustain the survival of malicious PDF file on the Internet, attackers circumvent the analysis process through diverse obfuscation techniques. Obfuscation methods used usually ranges from PDF syntax obfuscation, PDF filtering mechanism, JavaScript obfuscation, and variant from both methods. Because of rapid changes in methods of obfuscation, most antivirus software as well as security tools failed to detect malicious content inside PDF file, thus increasing the number of victims of malicious PDF mischief.

In this paper, we study in the obfuscation techniques used inside in-the-wild malicious PDF, how to make it more stealthy and how we can improve analysis on malicious PDF

I'm looking forward to meet old and new faces!. Will be my first time at DEFCON. :)

Honeynet Project Forensic Challenge on Malicious PDF

Ahmad Azizan and i released a challenge for Honeynet Project Forensic Challenge on our favorite topic, malicious PDF called, "Analyzing Malicious Portable Destructive Files".  We implemented a few tricks on making analysis harder inside the PDF file such as JavaScript obfuscations, PDF /Root component, and PDF syntax obfuscation and many more. It will be interesting to see how people will get the wrong shellcode execution. >;). Good Luck and enjoy the challenge.  We are definitely having a lot of fun while working on the challenge.

Please check out the challenge from Honeynet Project Forensic Challenge 6 page here.

Here is the challenge description:

The Challenge:

PDF format is the de-facto standard in exchanging documents online. Such popularity, however, has also attracted cyber criminals in spreading malware to unsuspecting users. The ability to generate malicious pdf files to distribute malware is functionality that has been built into many exploit kits. As users are less cautious opening PDF files, the malicious PDF file has become quite a successful attack vector.

The network traffic captured in lala.pcap contains network traffic related to a typical malicious PDF file attack, in which a unsuspecting user opens a compromised web page, which redirects the user's web browser to a URL of a malicious PDF file. As the PDF plug-in of the browser opens the PDF, the unpatched version of Adobe Acrobat Reader is exploited and, as a result, downloads and silently installs malware on the user's machine.

1. How many URL path(s) are involved in this incident? Please list down the URL path(s) found. (1pt)
2. What code can you find inside the PCAP file? Explain what the code does. (2pts)
3. What file(s) can you find within the PCAP file? If any files are found, please zip compress into password protected file (password infected) with file name: [your email]_Forensic Challenge 2010 – Challenge 6 – Extracted Files.zip and submit to http://www.honeynet.org/challenge2010/. (3pts)
4. How many object(s) are contained inside the PDF file? (1pt)
5. Using PDF dictionary and object referencing, explain in detail the flow structure of a PDF file. (1pt)
6. How many filtering schemes are used for the object streams and what are they? Explain how you can decompress the stream. (1pt)
7. Which object streams might contain malicious content? List the object and explain the obfuscation technique(s) used. (3pts)
8. What exploit(s) are contained inside the PDF file? Which one that actually runs and triggers the vulnerability(ies)? Please provide some explanation for your answer. (4pts)
9. Are there any payloads inside the PDF file? If any, list them all and explain what they do. Which payload will be executed? (2pts)
10. With the understanding of the PDF format structure, please explain how we can enable other exploits to run when the PDF file is opened. (2pts)

Bonus:

1. Please provide the dot graph of the PDF object’s connectivity inside the PDF file. (1pt)
2. Please provide an automated solution to extract and analyze JavaScript code within the PDF file. Be creative! (describe your solution below, but submit any source code and executable in a compressed zip file with file name [your email]_Forensic Challenge 2010 – Challenge 6 – Bonus2.zip via our submission formhttp://www.honeynet.org/challenge2010/.) (1pt)

To get it started, you need to start by inspecting a PCAP file. It can be downloaded from this page. 

Malicious PDF Technical Analysis Write Up

For the 2010, i spent a bit of my time on poking with malicious PDF analysis. I came up with a technical write up for the analyzing malicious pdf. The title for the write up is "Getting Owned by Malicious PDF". I split the write up into multiple samples sorting from easy-to-moderate of challenges and obstacle when dealing with malicious pdf analysis.

It starts with an introduction on PDF structures and components. The next section is on analyzing with vanilla pdf which only have a plain and flat PDF structure. This is a good introduction to familiar audience to PDF structure and also to expose on malicious pdf threat. On this sample, the analysis focus on understanding the PDF internal and extracting interesting components such as /Root object, javascript code and shellcode (within the javascript code).

The second sample involves with compressed PDF components by utilizing PDF feature, /Filter. /Filter will allow any PDF objects to be compressed using compression algorithms and decoding method such as zlib compression for /FlatDecode filter, ascii-to-hex for /ASCIIHexDecode filter. There are many methods can be implemented. Please read a good PDF Specification  format by Adobe.

For the details on samples 3, 4 please feel free to download and read the write up from SANS's web page here. 

Hello Miami and Lets Talk on Portable Desctructive PDF.

I'll speaking at the 22th FIRST conference at Miami next week. The topic of my presentation is PDF: Portable Destructive File: Attacks And Analysis. I'll be sharing on dissecting malicious PDF and how we can perform an analysis on the malicious PDF file. Below is my abstract for the presentation.[http://conference.first.org/2010/Program/program.aspx]


Portable Destructive File (PDF) Attacks and Analysis

The increased prevalence of malicious Portable Document Format (PDF) files has generated interest in techniques to perform analysis on such document.We have observed a lot of attacks try to abuse the PDF vulnerabilities by hosting malicious pdf files on the Internet. The modus operandi involved in lurking people to open malicious PDF files by using social engineering attack. The emails were sent with a link to PDF file, by attaching the malicious PDF file directly to trap victim to open the files.

In this presentation we will share with you on how to analyze malicious PDF files which abusing JavaScript for exploitation and as well as using it as attacker payloads. What you will learn here will help you to analyze malicious PDF files on your own by using freely available tools.