$1 Yacht Sale: Tampering with Signed PDFs in Plain Sight
Resumo
The Portable Document Format (PDF) is a popular way of sharing electronic documents. It is a format used across fields to represent official documents, many of which require strong guarantees that no unauthorized modifications are made to their contents. Digital signatures can be used to protect both the integrity and authenticity of a document, allowing an entity, whether a person, business, or service, to testify to one specific state of the document such that any non-permitted modification, for example altering the value of a contract or a health prescription, invalidates the signature. In this paper we introduce two novel attack classes that abuse flaws in the PDF specification to visually modify a page of a signed document without invalidating the signature or warning the user: Appearance Substitution Attack (ASA) and Signature Field Duplication Attack (SFDA). While previous works already explored incremental updates, we tap into modifications to the signature field itself, a specific kind of update that has yet to be fully explored. Our evaluation found that 13 out of 16 tested GUI applications and 2 popular verification libraries were at least partially vulnerable to one of the attack classes. We also propose countermeasures and specification improvements for fixing both.
Referências
Adobe Inc. (2026b). Adobe Acrobat Reader DC. [link]. Accessed on 2026-05-10.
Anliker, C., Lain, D., and Cǎpkun, S. (2025). Phishing attacks against password manager browser extensions. In Proceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA. USENIX Association.
Brazil (2020). Lei no 14.063, de 23 de setembro de 2020.
BRY Tecnologia (2026). BRY Verifica. [link]. Accessed on 2026-05-24.
CenturySign (2026). CenturySign. Unreleased product.
Certisign (2026). Certisign Verificador de Assinaturas. [link]. Accessed on 2026-05-24.
Clicksign (2026). Clicksign Validador. [link]. Accessed on 2026-05-24.
Code Industry Ltd. (2026). Master PDF editor. [link]. Accessed on 2026-05-24.
DigitalSign (2026). DigitalSign Signatures Validator. [link]. Accessed on 2026-05-24.
DPDSA (2026). Validation of Electronically Signed PDF Documents. [link]. Accessed on 2026-05-24.
EU (2014). Regulation (EU) No 910/2014. Official Journal of the European Union.
European Commission (2026a). Digital Signature Services (DSS). [link]. Accessed on 2026-05-24.
European Commission (2026b). DSS Demonstration WebApp: Signature Validation. [link]. Accessed on 2026-05-24.
Foxit Software Inc. (2026). Foxit PDF reader. [link]. Accessed on 2026-05-10.
ISO (2020). Document management — Portable document format — Part 2: PDF 2.0 . Standard ISO 32000-2:2020, International Organization for Standardization, Geneva, Switzerland.
ITI (2026). Validador de assinaturas ITI. [link]. Accessed on 2026-05-24.
Mainka, C., Mladenov, V., and Rohlmann, S. (2021). Shadow attacks: Hiding and replacing content in signed pdfs. In Proceedings of the Network and Distributed System Security Symposium (NDSS).
Microsoft Corporation (2026). Microsoft Edge. [link]. Accessed on 2026-05-24.
Mladenov, V., Mainka, C., Meyer zu Selhausen, K., Grothe, M., and Schwenk, J. (2019). 1 trillion dollar refund: How to spoof pdf signatures. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS ’19, page 1–14, New York, NY, USA. Association for Computing Machinery.
Müller, J., Ising, F., Mladenov, V., Mainka, C., Schinzel, S., and Schwenk, J. (2019). Practical decryption exfiltration: Breaking pdf encryption. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS ’19, page 15–29, New York, NY, USA. Association for Computing Machinery.
Müller, J., Noss, D., Mainka, C., Mladenov, V., and Schwenk, J. (2021). Processing dangerous paths: On security and privacy of the portable document format. In Proceedings of the Network and Distributed System Security Symposium (NDSS).
ON-RCPN (2026). ON-RCPN. [link]. Accessed on 2026-08-03.
RNP (2026). RNP verificador de assinaturas. [link]. Accessed on 2026-08-03.
Rohlmann, S., Mladenov, V., Mainka, C., and Schwenk, J. (2021). Breaking the specification: Pdf certification. In 2021 IEEE Symposium on Security and Privacy (SP), pages 1485–1501.
The Document Foundation (2026). LibreOffice. [link]. Accessed on 2026-05-10.
UFSC (2026). UFSC verificador de assinaturas. [link]. Accessed on 2026-08-04.
U.S. Congress (2000). Electronic Signatures in Global and National Commerce Act. Public Law 106–229, 114 Stat. 464, 15 U.S.C. ch. 96.
Valvekens, M. (2026). pyHanko: PDF signing and validation library for Python. [link]. Accessed on 2026-05-24.
ZapSign (2026). ZapSign Validador. [link]. Accessed on 2026-05-24.
