Downloading files from the internet has always been a risky business – and PDF files are no exception. Oftentimes, users don’t think twice before they download a PDF file from the web. And while PDFs seem harmless, they can, unfortunately, carry malicious code that could cause serious damage to an organization.
EdgeSpot, an exploit detection service, has identified a range of malicious PDF files in the wild – all containing a specific type of zero-day malware designed to harvest user data behind-the-scenes when the files are opened in Chrome. And as if this threat wasn’t concerning enough, you may not be able to rely on the security solution you have in place. In fact, PDF malware can evade traditional, detection-based solutions quite easily.
Now, it’s imperative for organizations to know how to strengthen their security measures and protect their network and employees against these types of attacks. While you may think the PDF malware detection solution you have in place will do the trick, it’s no longer enough. Let’s dive into why you should take a proactive approach to combat PDF malware.
What is PDF Malware?
First, you may be wondering how a PDF file may become infected. Through Javascript, system commands, hidden objects, and multimedia control, malware can easily be injected into a file. PDFs are easy to edit, therefore making them a perfect target for hackers to hide malicious code in. And since PDFs have the ability to execute code right on your device, PDF malware can be especially harmful.
Additionally, some attacks play on the vulnerabilities of PDF readers. This means that whether you’re downloading a file from the internet or right from your inbox, sometimes the greatest danger lies in how you read them.
All in all: PDF malware is dangerous, and every employee at your organization should be aware of it.
How Does PDF Malware Work?
Imagine you’ve opened a PDF file in your browser. The document looks exactly as you imagined it – and there’s no sign that anything is out of the ordinary. Yet, your personal data is already on the way to some remote location and there’s nothing you can do about it. This particular malware collects many types of information – including IP addresses, Chrome browser versions, PDF file paths, and operating system details – sending them through an HTTP POST request to a remote server. If that doesn’t sound worrying already – EdgeSpot reports said that almost every antivirus failed to detect the PDF malware and even marked the files as “clean”! With this level of sophistication, cybercriminals can easily gather the data they’re looking for, and compromise your organization’s entire network.
Going Beyond PDF Malware Detection
PDF malware is certainly an unusual mode of attack, but your organization must stay vigilant. Google suggests that Chrome users in particular are extra careful with PDF documents, only opening trusted files, or using other PDF viewers instead of Chrome’s built-in one. While awareness of the exploit is one step forward – it’s nowhere near enough to guarantee protection.
Zero-day malware like this often evades traditional detection through antivirus – so that’s no surprise. The question is – what can be done to ensure protection when opening PDF files in Chrome? And in general, how can we ensure file-based exploits like this don’t compromise our systems? Especially in an organization where PDF files are commonly shared around – and it would be easy for an infected one to find its way in.
All it takes is for your PDF malware detection to fail and one user to open a malicious file by mistake, and the cascade of events that follow can be catastrophic. Many organizations hold private data that would cause great losses (financial and otherwise) if it falls into the wrong hands – so preventing malware infections is vital.
When Detection-Based Solutions Are No Longer Enough
So, how do you protect your organization from PDF malware? Instead of waiting to react, you should consider a proactive approach such as file sanitization. At Votiro, our Positive Selection technology sanitizes every file before it ever reaches your network. By disassembling incoming files, neutralizing potential threats, and reassembling those same files, Votiro’s technology can ensure every PDF that comes your way is clean and safe to use. The entire process takes under a second, and files retain full functionality. Users can carry on work as normal, without presenting a security risk to the organization, downloading and using files as needed.
Unfortunately, attacks will only become more sophisticated, and this PDF exploit is unlikely to be the last of its kind. With new types of zero-day malware cropping up all the time, consider implementing a solution that can guarantee your safety. Take a no-nonsense approach to protection from zero-day threats with Votiro Cloud. When every file is sanitized, you won’t have to worry about the damage a malicious PDF file could cause.
Interested in protecting your organization against PDF malware? Schedule a demo with us today to see how our solution works. Or, please feel free to contact us today for more information!