The Portable Document Format, better known as PDF, is one of the most widely used document formats worldwide, and in order to ensure information confidentiality, this file format supports document encryption. In this paper, the authors analyze PDF encryption and show two novel techniques for breaking the confidentiality of encrypted documents.
517f98746fe2867354db4d9e80fb07916b9d1d2b6c386ab280af27aaadc9b848
A missing anchor in generated regex for rack-cors versions prior to 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
9e2393521935f0c2d55d8bbcb87e105d1c088b74bf965cd2698351eafce20ff4
This post is about putting printers out of their misery and destroying the NVRAM through ordinary print jobs.
e2cd86b8adc6667167b8f7b8f181989c96fee30d127929b13743dc8b7d1e5967
This post is about resetting a printer to factory defaults through ordinary print jobs, therefore bypassing all protection mechanisms like user-set passwords.
c0d3ac08f94bc071adf9e63784f30829f42fad0694c4e352f9eb78b9c01cd3f8
This post is about buffer overflows in a printer's LPD daemon and PJL interpreter which leads to denial of service or potentially even to code execution. Multiple printers are affected.
ed3f781546ee705d1385f6e94873f6738e66f693d3e7c6ffb379426cacaefa6b
This post is about abusing Brother's proprietary PJL extensions to dump the printers NVRAM and gain access to interesting stuff like passwords.
64ec02b37690bb546138e1297152bd405cb48e04234c442b4a8aec0a22fd3850
This post is about accessing a printers file system through ordinary PostScript or PJL based print jobs -- since decades a documented feature of both languages. The attack can be performed by anyone who can print, for example through USB or network. It can even be carried out by a malicious website, using advanced cross site printing techniques in combination with a novel technique we call CORS spoofing.
c418874775830be69d70d766dd0802c21da19fba2301929c1dd21e23ad79ce68
This post is about manipulating and obtaining documents printed by other users, which can be accomplished by infecting the printer with PostScript malware.
9abc3f6da5a87fc7c87c58ebcb60b7ead620ec10be3c424d01c2e0514ee518ae