Hacker News Reader

PDFs also have a scripting language built in, right? Could that be a good attack vector?

It seems like a pretty good site to attack people from, for social reasons. It sits at a nice confluence of: technically unauthorized copying, but feels like not such a big deal. And getting academic papers can be a PITA. And the audience is probably self-selecting for folks who are doing interesting STEM stuff.

View on HN

Surely at this point your average pdf viewer is sandboxed to hell and back? (Eg your browser).

If I wanted to run JS in someone’s browser I don’t need a pdf to do it.

I guess I’m thinking of somebody like myself, like I’ve known forever the prudent thing to do is disable JavaScript on my browser wherever possible. But I didn’t know PDFs had a built in scripting language until a couple years ago, I mostly use PDF for papers, where this isn’t as relevant.

In principle, any piece of software can have zero-days in it. PDF readers included.

Scripting languages can help with certain exploits, but arent vulnerabilities in and of themselves.

Anyhow, theoretically possible but also kind of unlikely. Such attacks usually have a shortish shelf life so are used in more targeted fashion to prolong the exploits life and get the most value from it.

Reply on news.ycombinator.com