37
5.2.1.1 Flash conversion script
To safely display the contents of uploaded documents back to the user, we convert them into
a Flash file. The advantage of this approach is that we can keep the PDF files saved safely in
non web accessible location and serve the Flash copies to the browser. The conversion is
handled by pdf2swf script from SWTools bundle, using following command:
pdf2swf -T 8 -B rfxview.swf [path to pdf] -o [path to output flash file]
Parameter -T let's us specify a version of Flash to be used and parameter -B rfxview.swf tells
the script to combine the file during conversion with a viewer. This allows the result to be
browsed in Flash player and adds a navigation panel.
5.2.1.2 Supplementing score system
To help determine whether uploaded file may be potentially harmful, the uploads are scored
using a python script. The original concept was put forth by Brandon Dixon in 2010 [41] and
it took advantage of the fact that malicious PDF files are usually small in size (less than 2
megabytes), with single page, close all streams and objects and contain JavaScript. Many of
the vulnerabilities that appeared in recent years took advantage of embedded files and Flash
content without using JavaScript. As such, RichMedia needs to be After testing with fifteen
malicious samples and twenty various clean samples, the following scoring system produced
most reliable results.
• add 1 point to primary score for JavaScript or RichMedia
• add 0.25 to primary score each for size under 1.8 megabytes, less then 2 pages,
number of obj equals number of endobj, number of stream equals number of
endstream
• add 0.5 to secondary score each for embedded files, JBIG2Decode, Launch,
OpenAction, AA, Colors
Based on the totals the file is judged suspicious when primary score is 1.5 or higher or when
primary score is 1 and and secondary score is 0.5 or higher. The file is judged to be high risk
when the primary score is 2 or higher and secondary score is 0.5 or higher. Otherwise the file
is marked as clean. Using this system, the biggest source of false positives are small forms
that make use of JavaScript. Using this system, there were two false positives caused by small
PDF forms that used JavaScript for form validation. However, since small files containing
JavaScript should always warrant followup inspection, these false positives are acceptable.
Out of fifteen tested malicious samples eight were marked as suspicious, seven as high risk
and none as false negatives.
5.2.1.3 Uploader component security
The uploader component is a potential source of several security holes that need to be
addressed. First, the security token, consisting of a md5 hash value of current timestamp
51
