{"id":41124,"date":"2021-05-26T06:46:11","date_gmt":"2021-05-26T06:46:11","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/contract-killer-certified-pdfs-can-be-secretly-tampered-with-during-the-signing-process-boffins-find\/"},"modified":"2021-05-26T06:46:11","modified_gmt":"2021-05-26T06:46:11","slug":"contract-killer-certified-pdfs-can-be-secretly-tampered-with-during-the-signing-process-boffins-find","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/contract-killer-certified-pdfs-can-be-secretly-tampered-with-during-the-signing-process-boffins-find\/","title":{"rendered":"Contract killer: Certified PDFs can be secretly tampered with during the signing process, boffins find"},"content":{"rendered":"

A pair of techniques to surreptitiously alter the content of certified PDFs have been detailed by researchers in Germany.<\/p>\n

The upshot is that someone could digitally add their signature to a PDF of, say, a contract, pass the file to a partner to digitally sign, and that second person could sneakily alter the contract’s text as well as sign it, creating confusion down the line. While the addition of the second signature would be permitted, the tampering of the text should be detected and flagged up by application software \u2013 unless the second person uses the aforementioned techniques.<\/p>\n

The exploits, dubbed Evil Annotation and Sneaky Signature, are detailed in a paper [PDF<\/a>] and website<\/a> by Ruhr University Bochum’s Simon Rohlmann, Dr Vladislav Mladenov, Dr Christian Mainka, and Professor J\u00f6rg Schwenk. The team were due to present their work at the 42nd IEEE Symposium on Security and Privacy, taking place online this week.<\/p>\n