defcon

http://www. elcomsoft .com Presentation on on DEF CON Nine, July 13 th - 15 th , 2001 Alexis Park in Las Vegas, Nevada USA eBooks security - theory and practice

eBooks security - theory and practice 1. Foreword 2. PDF encryption 3. Standard security handler 4. Rot13 handler 5. FileOpen handler 6. SoftLock handler 7. Adobe Web Buy handler (PDF Merchant) 8. Acrobat eBook Reader EBX handler (formerly GlassBook) http://www. elcomsoft .com 9. Arbitrary handler (obtaining encryption key from PDF viewer) 10. Security flaw in Acrobat plug-ins certification

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Electronic Publishing

Electronic Publishing/Reading Solutions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Related Internet resources: http://www. ebookcompilers .com/ http://www. elcomsoft .com ,[object Object],[object Object],[object Object]

eBook Pro compiler Short description (taken from www. ebookpro .com ) "eBook Pro", the only software in the universe that makes your information virtually 100% burglarproof! It comes with a lifetime, money-back guarantee "At Last, You Can Sell Information Online (And Make Thousands Of Sales Per Day) - Without The Danger Of Having Your Information Stolen And Resold By Others» http://www. elcomsoft .com Related Internet resources: http://www. ebookpro .com/ Actual features All HTML pages and supplementary files are compressed with deflate algorithm from ZLIB Compressed data are encrypted by XOR-ing each byte with every byte of the string “encrypted”, which is the same as XOR with constant byte

PDF file structure http://www. elcomsoft .com Related Internet resources: http://www.adobe.com/products/acrobat/ adobepdf .html Basic data types Example Boolean true Numeric 3.1415926 Object reference 23 0 R Name /ProcSet String (Contents) * Stream {binary data} * * - data could be encrypted <PDF file> ::= <header> <body> <cross-reference table> <trailer> <body> ::= <object> {<object>} <object> :: <objectID> (<data> | <stream dictionary> <stream>) Complex data types Example Array [23 0 R /XYZ null] Dictionary <</Name1 (Val1) /Name2 /Val2>>

PDF file encryption PDF Document <Encrypted Content> <<Encryption Dictionary>> Contains security handler name and supplementary information necessary to obtain encryption key http://www. elcomsoft .com Security handler Takes information from Encryption Dictionary , calculates document encryption key and passes it to PDF Viewer PDF Viewer Takes document encryption key , decrypts PDF document and display it on the screen Screen Related Internet resources: http://www.adobe.com/products/acrobat/ adobepdf .html

Object encryption key calculation Document encryption key http://www. elcomsoft .com Object ID + Generation MD5 HASH algorithm Object encryption key Document encryption key Scrambled Object ID + Generation MD5 HASH algorithm Object encryption key ‘ sAlT’ string Algorithm ver.1,2 Algorithm ver.3 Related Internet resources: http://www.adobe.com/products/acrobat/ adobepdf .html

Standard security handler ,[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Related Internet resources: http://www.adobe.com/products/acrobat/ adobepdf .html ,[object Object],[object Object],[object Object],[object Object],New User password restriction, introduced in Acrobat 5: ,[object Object],[object Object],[object Object],[object Object],Possible restrictions, when opened with User password:

Standard security handler http://www. elcomsoft .com Related Internet resources: http://www. elcomsoft .com/ apdfpr .html Time necessary for complete key enumeration (40 bits key) on PIII-450 Passwords per second on 450MHz Pentium III 15 hr 30 hr 60 hr 120 hr 240 hr 4 20 hr 40 hr 80 hr 160 hr 320 hr 3 30 hr 60 hr 120 hr 240 hr 480 hr 2 60 hr 120 hr 240 hr 480 hr 960 hr 1 512 GB 384 GB 256 GB 128 GB 0 GB PCs total HDD 1,610 102  MD5 + 40  RC4 3,250 51  MD5 + 20  RC4 Standard security handler 3 100,000 2  MD5 + 2  RC4 190,000 1  MD5 + 1  RC4 Standard security handler 2 Owner User Handler type P assword type

Rot13 security handler ,[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Related Internet resources: http://www. nprg .com/ ,[object Object],[object Object],[object Object],[object Object]

FileOpen security handler ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Related Internet resources: http://www. fileopen .com / ,[object Object],[object Object],[object Object]

SoftLock security handler ,[object Object],[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Related Internet resources: http://www. softlock .com/ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Adobe WebBuy (PDF Merchant) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Related Internet resources: http:// pdfmerchant .adobe.com/

Adobe’s Acrobat eBookReader (formerly GlassBook) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],http://www. elcomsoft .com Related Internet resources: http://www. ebxwg .org/ http://www.adobe.com/products/ contentserver /main.html ,[object Object],[object Object],[object Object],[object Object],[object Object]

Adobe’s Acrobat eBookReader (formerly GlassBook) http://www. elcomsoft .com Related Internet resources: http://www.adobe.com/products/ contentserver /main.html Interim key calculation from hardware IDs CPU ID+ Volume ID SHA1 mor.dat file son.dat file Voucher RC5 Decrypt RSA Decrypt Private RSA key Document key Interim key Interim key RC5 Decrypt Fixed key Interim key Interim key calculation from hidden copy Document key calculation

Obtaining encryption key from PDF viewer http://www. elcomsoft .com ,[object Object],[object Object],[object Object],Anti reverse-engineering measures in PDF viewers How to find code of MD5 functions No PACE InterLok PACE InterLok eBook Reader No In DocBox plug-in No Acrobat 5 No No No Acrobat 4 Code integrity checking Debugger detection Code encryption Application name

Security flaw Acrobat plug-ins certification mechanism http://www. elcomsoft .com ,[object Object],[object Object],[object Object],[object Object],[object Object],How to certify plug-in Why to certify plug-in ,[object Object],How certificate validity is checked ,[object Object],How to bypass plug-ins certificate checking

defcon

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (20)

More from guestfbf1e1

More from guestfbf1e1 (14)

Recently uploaded

Recently uploaded (20)

defcon