$1 Yacht Sale: Tampering with Signed PDFs in Plain Sight

Abstract

The Portable Document Format (PDF) is a popular way of sharing electronic documents. It is a format used across fields to represent official documents, many of which require strong guarantees that no unauthorized modifications are made to their contents. Digital signatures can be used to protect both the integrity and authenticity of a document, allowing an entity, whether a person, business, or service, to testify to one specific state of the document such that any non-permitted modification, for example altering the value of a contract or a health prescription, invalidates the signature. In this paper we introduce two novel attack classes that abuse flaws in the PDF specification to visually modify a page of a signed document without invalidating the signature or warning the user: Appearance Substitution Attack (ASA) and Signature Field Duplication Attack (SFDA). While previous works already explored incremental updates, we tap into modifications to the signature field itself, a specific kind of update that has yet to be fully explored. Our evaluation found that 13 out of 16 tested GUI applications and 2 popular verification libraries were at least partially vulnerable to one of the attack classes. We also propose countermeasures and specification improvements for fixing both.