jueves, 25 de mayo de 2023
1248 hash passwords
ripemd320( jwfox777 ) ripemd320( jwg1 ) ripemd320( jwg2000 ) ripemd320( jwg6454 ) ripemd320( JwG74 ) ripemd320( jWg7DmSc ) ripemd320( jwgacy ) ripemd320( jwGmEi3W2JoSo ) ripemd320( jwh18007 ) ripemd320( jwh1848 ) ripemd320( jwh1970 ) ripemd320( jwh31170 ) ripemd320( jwhi1433 ) ripemd320( jwhite ) ripemd320( jwhoopie ) ripemd320( JwHw6N ) ripemd320( JwHw6N1 ) ripemd320( JwHw6N1742 ) ripemd320( jwidome ) ripemd320( jwil ) ripemd320( jwilke ) ripemd320( jwillie ) ripemd320( jwillis ) ripemd320( jwilson ) ripemd320( jwilt ) ripemd320( jwinch ) ripemd320( jwjwjw ) ripemd320( jwkwlcmc ) ripemd320( jwla4366 ) ripemd320( jwlarkin ) ripemd320( jwlennon ) ripemd320( jwlu1873 ) ripemd320( Jwm36202 ) ripemd320( jwm8670 ) ripemd320( jwmptm ) ripemd320( jwn2000 ) ripemd320( jwOGq ) ripemd320( jwok ) ripemd320( jwolfe ) ripemd320( jwood ) ripemd320( jwoods ) ripemd320( jwoody1 ) ripemd320( jworkers ) ripemd320( jwp2781 ) ripemd320( jwp666 ) ripemd320( jwrdeh-48 ) ripemd320( Jwrich ) ripemd320( jwrjwr ) ripemd320( jws1 ) ripemd320( jws123 ) ripemd320( jws1945 ) ripemd320( jws45ge ) ripemd320( jwsewall ) ripemd320( jwsjws ) ripemd320( jwsp51 ) ripemd320( JWSStang ) ripemd320( jwswann9 ) ripemd320( jwtyrf ) ripemd320( JwubfHr6 ) ripemd320( jwus73a ) ripemd320( jwvh70a ) ripemd320( jwvmds94 ) ripemd320( jwwvxr ) ripemd320( JWyqQ ) ripemd320( jwywxt ) ripemd320( jx36th08 ) ripemd320( jx76tms ) ripemd320( jx7z3rK1dV ) ripemd320( JXaFdMtz ) ripemd320( jxcoppes ) ripemd320( jxdscjrj ) ripemd320( JxduMb ) ripemd320( jxevtnm ) ripemd320( jxfdtn ) ripemd320( jxfhjdfir ) ripemd320( jxfhjdfirf ) ripemd320( jxfhjdfybt ) ripemd320( jxg8rin8 ) ripemd320( jxgjw202 ) ripemd320( jxp693 ) ripemd320( jxpmtTMU ) ripemd320( jxq74e4z9m ) ripemd320( jxrfhbr ) ripemd320( jxsr000426 ) ripemd320( jxtymghjcnj ) ripemd320( jxtymghjcnjq ) ripemd320( jxtymrhfcbdsq ) ripemd320( jxtymyflj ) ripemd320( jxwzjb ) ripemd320( jxxx ) ripemd320( JXY542 ) ripemd320( jxz45946 ) ripemd320( jxzob5 ) ripemd320( jy1234 ) ripemd320( jy451z ) ripemd320( jy5505sa ) ripemd320( jY69zzr ) ripemd320( jy6eems6 ) ripemd320( jyadala ) ripemd320( JYBaBa68 ) ripemd320( JYbbm ) ripemd320( jybe6bkb ) ripemd320( jybnln ) ripemd320( jybotyrj ) ripemd320( jybrc ) ripemd320( jybtyy ) ripemd320( jychsd01 ) ripemd320( JYcY8Agy ) ripemd320( jyd123 ) ripemd320( JyEuNB ) ripemd320( jyexHKiF ) ripemd320( jyfcfvfz ) ripemd320( jyfdsbuhftn ) ripemd320( jYFEi ) ripemd320( jyfgde45 ) ripemd320( jyfjyf ) ripemd320( JyFSCG ) ripemd320( jyg969 ) ripemd320( jyhad ) ripemd320( jyh-chwe ) ripemd320( jyhGkE ) ripemd320( jyhjyh ) ripemd320( jyh-shin ) ripemd320( jyjnjkt ) ripemd320( jyjyjy ) ripemd320( jykfqy ) ripemd320( jylland ) ripemd320( jymbob ) ripemd320( jymjym ) ripemd320( jymjym56 ) ripemd320( jymmij ) ripemd320( jymy ) ripemd320( jyndbqxm ) ripemd320( jynx ) ripemd320( jyo899 ) ripemd320( jyoder ) ripemd320( jyorick ) ripemd320( jyothi ) ripemd320( jyothi560094 ) ripemd320( jyoti ) ripemd320( jyotipanthi ) ripemd320( jyotiunifor ) ripemd320( jyoung ) ripemd320( jyrassik554604 ) ripemd320( jyrhsw ) ripemd320( jyrjn22 ) ripemd320( jyrki69 ) ripemd320( JYrYmaRy8A6U6y ) ripemd320( JYs6WZ ) ripemd320( jyswill ) ripemd320( jyswill09 ) ripemd320( jytuby ) ripemd320( jyuen1 ) ripemd320( jyujinkai ) ripemd320( jyunia ) ripemd320( jyunko ) ripemd320( Jyyb227322 ) ripemd320( jz0523 ) ripemd320( jz1972 ) ripemd320( jz5115 ) ripemd320( jz55436 ) ripemd320( jz5bwkxz ) ripemd320( Jz6Asv ) ripemd320( jz9332 ) ripemd320( jzavafox ) ripemd320( JZbcm ) ripemd320( JzBuFxU ) ripemd320( jzeekw ) ripemd320( jzegna ) ripemd320( jZf7qF2E ) ripemd320( JzFSjH ) ripemd320( Jzfuob ) ripemd320( JzfuOB ) ripemd320( jzhorn ) ripemd320( jziggy ) ripemd320( jzjzjz ) ripemd320( jZL5zVXcA7 ) ripemd320( jzmY707Y ) ripemd320( jzneub ) ripemd320( jzonyx20 ) ripemd320( JzThWF ) ripemd320( jzucc08 ) ripemd320( jzx100 ) ripemd320( jzx90 ) ripemd320( k000000 ) ripemd320( k001823 ) ripemd320( k001aid3 ) ripemd320( k0080503 ) ripemd320( k009tr ) ripemd320( k00la1d ) ripemd320( K00lB3tty ) ripemd320( k00ljay1 ) ripemd320( k010231 ) ripemd320( k0104846 ) ripemd320( K01071990z ) ripemd320( k011101 ) ripemd320( k018536942 ) ripemd320( k018969 ) ripemd320( k01ibri ) ripemd320( k020274 ) ripemd320( k021137 ) ripemd320( k021273 ) ripemd320( k02143006 ) ripemd320( k0331 ) ripemd320( k03310401s ) ripemd320( k034203554 ) ripemd320( k0393539 ) ripemd320( k0707143 ) ripemd320( k070876 ) ripemd320( k084596 ) ripemd320( k0876760 ) ripemd320( k090909 ) ripemd320( k09231991 ) ripemd320( k0977564907 ) ripemd320( k09cj3sm ) ripemd320( k0a9n8t7 ) ripemd320( K0CLAWSK0 ) ripemd320( k0cs1990 ) ripemd320( k0diak ) ripemd320( k0e0n7t ) ripemd320( k0edupro ) ripemd320( k0elsch ) ripemd320( k0f1r1ng ) ripemd320( K0gzg$f ) ripemd320( k0ight ) ripemd320( k0j9h8 ) ripemd320( k0k098 ) ripemd320( k0k0k0 ) ripemd320( k0l0b0k ) ripemd320( k0l0k0l ) ripemd320( k0lbasa ) ripemd320( k0lopatr ) ripemd320( k0MkUXN ) ripemd320( k0mmisa321R ) ripemd320( K0n1ng ) ripemd320( k0ndex ) ripemd320( k0nitha ) ripemd320( k0opkout ) ripemd320( k0pp1tes ) ripemd320( k0r0tk0v ) ripemd320( k0s0v0 ) ripemd320( k0s2900679 ) ripemd320( k0taku ) ripemd320( k0z6cz ) ripemd320( k1000 ) ripemd320( K10010071981 ) ripemd320( k100rs ) ripemd320( k1079999 ) ripemd320( k108639rs ) ripemd320( k1100lt ) ripemd320( k1100rs ) ripemd320( k11011995 ) ripemd320( k1110mah ) ripemd320( k11111 ) ripemd320( k11111111 ) ripemd320( k1111s ) ripemd320( k11424 ) ripemd320( k1145k ) ripemd320( k115526 ) ripemd320( k1200 ) ripemd320( k1200lt ) ripemd320( k1200lte ) ripemd320( k1200rs ) ripemd320( k1200s ) ripemd320( k121598 ) ripemd320( k123 ) ripemd320( K123123 ) ripemd320( k123321 ) ripemd320( k1234 ) ripemd320( k12345 ) ripemd320( k123456 ) ripemd320( K123456 ) ripemd320( k1234567 ) ripemd320( K1234567 ) ripemd320( k12345678 ) ripemd320( k123456789 ) ripemd320( K123456789 ) ripemd320( k1234567890 ) ripemd320( k123456a ) ripemd320( K123456k ) ripemd320( k12345k ) ripemd320( k123lj ) ripemd320( k124567 ) ripemd320( K124598k ) ripemd320( k126nrt ) ripemd320( k12861 ) ripemd320( k12saw ) ripemd320( k13579 ) ripemd320( k13i07v87 ) ripemd320( k140185 ) ripemd320( k14456 ) ripemd320( k1500 ) ripemd320( k154367 ) ripemd320( k155m3ka ) ripemd320( k155th15 ) ripemd320( k15wdj ) ripemd320( k161616 ) ripemd320( k170399 ) ripemd320( k17-k17 ) ripemd320( k17m93ar ) ripemd320( K181174K ) ripemd320( k182236 ) ripemd320( k182sbr ) ripemd320( k1972 ) ripemd320( K19781976 ) ripemd320( K1987ler ) ripemd320( k199514 ) ripemd320( k1996300810 ) ripemd320( k19980511v ) ripemd320( k19n59s ) ripemd320( k1a1t1y1a1 ) ripemd320( k1a2t3 ) ripemd320( k1a2t3a4 ) ripemd320( k1a2t3e4 ) ripemd320( k1a2t3y4 ) ripemd320( k1a2t3y4a5 ) ripemd320( k1a723min ) ripemd320( k1b1n1 ) ripemd320( k1f4c8 ) ripemd320( k1i2m3 ) ripemd320( k1i2r3i4l5l6 ) ripemd320( k1i2s3a4 ) ripemd320( k1ight ) ripemd320( k1j1x1 ) ripemd320( k1j2h3h4A7 ) ripemd320( k1k1k1 ) ripemd320( k1k1k1k1 ) ripemd320( k1k2k3 ) ripemd320( k1k2k3k4 ) ripemd320( k1k2k3k4k5 ) ripemd320( k1ku1ch1m0j1 ) ripemd320( k1lkaa ) ripemd320( k1ll3r ) ripemd320( K1LL4h ) ripemd320( K1llas ) ripemd320( k1llb1ll ) ripemd320( k1lle ) ripemd320( k1ller ) ripemd320( K1LLER ) ripemd320( k1llg0d ) ripemd320( k1llg0d1 ) ripemd320( k1llr0y ) ripemd320( k1m1l31 ) ripemd320( k1m2n3 ) ripemd320( k1mandn1co ) ripemd320( k1mberly ) ripemd320( k1mp3tcuk ) ripemd320( k1msmIth ) ripemd320( k1n2b3 ) ripemd320( k1n9hb ) ripemd320( k1nglou ) ripemd320( k1nkyB0y ) ripemd320( k1o2l3 ) ripemd320( k1pper ) ripemd320( k1r1agn1da ) ripemd320( k1r1bat1 ) ripemd320( k1r2i3s4 ) ripemd320( k1r5t3n ) ripemd320( k1rch3r ) ripemd320( k1ro2nc3 ) ripemd320( k1rst3n ) ripemd320( k1sCu ) ripemd320( k1ssme ) ripemd320( k1syst ) ripemd320( k1tr4c3r ) ripemd320( k1tten ) ripemd320( k1tty1 ) ripemd320( k1vd2sz5 ) ripemd320( k1z0llina ) ripemd320( k1zb0g ) ripemd320( k2000 ) ripemd320( K200209 ) ripemd320( k200599 ) ripemd320( k20102010 ) ripemd320( K20189 ) ripemd320( k202502 ) ripemd320( k20doh ) ripemd320( k210snap ) ripemd320( k2112 ) ripemd320( k21971 ) ripemd320( k222006 ) ripemd320( K222030 ) ripemd320( k22539902 ) ripemd320( k2348028 ) ripemd320( k2361994 ) ripemd320( K23DhEwf ) ripemd320( k24011985 ) ripemd320( k240499 ) ripemd320( k2405062 ) ripemd320( k240889 ) ripemd320( K241077 ) ripemd320( k24k10 ) ripemd320( k24m20l4k28 ) ripemd320( k24p13 ) ripemd320( k2500 ) ripemd320( k26349 ) ripemd320( k2700ra ) ripemd320( k27499 ) ripemd320( k27905212p ) ripemd320( k279gh ) ripemd320( k28611 ) ripemd320( k28bxb4a ) ripemd320( k291819 ) ripemd320( K29oliwa ) ripemd320( k2a7la ) ripemd320( k2c2k2c2 ) ripemd320( k2cole ) ripemd320( k2dvk1999 ) ripemd320( k2dvk99 ) ripemd320( k2eehh8c ) ripemd320( k2efg729 ) ripemd320( k2ight ) ripemd320( k2jf2d ) ripemd320( k2k2 ) ripemd320( k2k2k2 ) ripemd320( k2k2k2k2 ) ripemd320( k2kyle ) ripemd320( k2n75MIv ) ripemd320( k2nyca ) ripemd320( k2q10rp ) ripemd320( k2qagk ) ripemd320( k2r3i0s7 ) ripemd320( k2skis ) ripemd320( K2TriX ) ripemd320( k2ufdyj ) ripemd320( k2xjnvw ) ripemd320( k2xox0cu ) ripemd320( k2XS85pGNffC ) ripemd320( k2zeppli ) ripemd320( k304522 ) ripemd320( K30u74 ) ripemd320( k310886 ) ripemd320( k31415 ) ripemd320( k3155482M ) ripemd320( k323jleed2i9 ) ripemd320( k32lls ) ripemd320( k33548 ) ripemd320( k33llmmm ) ripemd320( k33llnnn ) ripemd320( k33lmnnn ) ripemd320( k33lyc ) ripemd320( k33p0ut ) ripemd320( k33p3r ) ripemd320( k361054 ) ripemd320( k3624xG ) ripemd320( k37345 ) ripemd320( k3774b ) ripemd320( k37ahd ) ripemd320( K37AHD ) ripemd320( k385557843 ) ripemd320( k3860903 ) ripemd320( k3b0637 ) ripemd320( k3f2 ) ripemd320( k3Gr8Q4U ) ripemd320( K3hdTP ) ripemd320( k3i902tk ) ripemd320( k3ight ) ripemd320( k3ins2k ) ripemd320( k3lwss ) ripemd320( K3NK78N5 ) ripemd320( k3nn12913 ) ripemd320( k3nn3dy ) ripemd320( k3nny97 ) ripemd320( k3Omb ) ripemd320( k3ozm ) ripemd320( k3po ) ripemd320( k3rima ) ripemd320( k3rm1 ) ripemd320( k3rm1t ) ripemd320( k3rmit ) ripemd320( k3str3l ) ripemd320( k3tsg ) ripemd320( k3u0v8 ) ripemd320( k3v1n ) ripemd320( k3v1nh ) ripemd320( k3v1nw ) ripemd320( k3wl3st ) ripemd320( k3xu84 ) ripemd320( k3yskfo0 ) ripemd320( k3zuX58gemR ) ripemd320( k416neg2841 ) ripemd320( k423oo ) ripemd320( k43632 ) ripemd320( k4381661 ) ripemd320( k43qen7l ) ripemd320( k446zcg ) ripemd320( K44f7E2f ) ripemd320( k452ju65 ) ripemd320( k45rt8x ) ripemd320( k46irw6Q2Wgr9 ) ripemd320( k475777 ) ripemd320( k4763 ) ripemd320( K47F325 ) ripemd320( k485769 ) ripemd320( k4888241 ) ripemd320( k49164442 ) ripemd320( k4997624486 ) ripemd320( k4abm62w ) ripemd320( k4athlee ) ripemd320( k4fdx9 ) ripemd320( k4graph ) ripemd320( k4hvd ) ripemd320( k4hvdk4hvd ) ripemd320( k4hvdq9tj9 ) ripemd320( k4ight ) ripemd320( k4k4sh12 ) ripemd320( k4k5k6 ) ripemd320( k4k6y5 ) ripemd320( k4l4n1dr ) ripemd320( k4lijati ) ripemd320( k4mCv ) ripemd320( K4rdg677 ) ripemd320( k4T13bp ) ripemd320( k4wlBIc844 ) ripemd320( K4XJ6 ) ripemd320( K4Z856T1 ) ripemd320( k500781s ) ripemd320( k.5081955f ) ripemd320( k52307 ) ripemd320( K52584 ) ripemd320( k5262b ) ripemd320( k5267333 ) ripemd320( k528me ) ripemd320( k52d3Y7 ) ripemd320( k52p98ju ) ripemd320( k53559 ) ripemd320( k5355de ) ripemd320( k538925 ) ripemd320( k543 ) ripemd320( k5544o ) ripemd320( k55555 ) ripemd320( k56013 ) ripemd320( k5692v ) ripemd320( k57343 ) ripemd320( k5820c ) ripemd320( k5883e ) ripemd320( k588f22 ) ripemd320( K58C4z ) ripemd320( k5bhn3 ) ripemd320( k5blazer ) ripemd320( k5d3wuho ) ripemd320( k5dfwtex ) ripemd320( k5e3w9l5 ) ripemd320( k5et02mb ) ripemd320( k5ff3eoo ) ripemd320( k5i6rsjf ) ripemd320( k5ight ) ripemd320( k5jJJDM4 ) ripemd320( k5melyon ) ripemd320( k5n5b5 ) ripemd320( K5o3R8n ) ripemd320( k5o4a3l2 ) ripemd320( k5r2rftx ) ripemd320( k5tj7y6p ) ripemd320( k5uk5u ) ripemd320( k5vz13qu ) ripemd320( k5w3tnfa ) ripemd320( k617re ) ripemd320( k61ew68k ) ripemd320( k622 ) ripemd320( k62300m ) ripemd320( k62460 ) ripemd320( k63514 ) ripemd320( k63cq63z ) ripemd320( k64983meAx ) ripemd320( k6500kl ) ripemd320( k654321 ) ripemd320( k655783 ) ripemd320( K65rrY ) ripemd320( k663bk ) ripemd320( k6650003 ) ripemd320( k680429 ) ripemd320( K689MB78 ) ripemd320( k6bfcpxt ) ripemd320( k6d5raz4 ) ripemd320( k6dumyde ) ripemd320( k6giuijv ) ripemd320( k6gvfa ) ripemd320( k6if9qam7c ) ripemd320( k6ight ) ripemd320( k6jvuuamvj ) ripemd320( k6rdgn ) ripemd320( k6W92744 ) ripemd320( k6zE5J65 ) ripemd320( k700 ) ripemd320( k70k70 ) ripemd320( k7107640 ) ripemd320( k710fazet ) ripemd320( k71r62 ) ripemd320( k72a4c ) ripemd320( k72z1zpwCG ) ripemd320( k732mn4 ) ripemd320( k7338f ) ripemd320( k74141069 ) ripemd320( k7452 ) ripemd320( k750ukl ) ripemd320( k7539601s ) ripemd320( k75rta ) ripemd320( k76195 ) ripemd320( k76300 ) ripemd320( k7777777 ) ripemd320( k77x2u ) ripemd320( k782ruts ) ripemd320( k79952 ) ripemd320( k7b31a51 ) ripemd320( k7dn9v ) ripemd320( K7gONkO768 ) ripemd320( k7k3g7hs ) ripemd320( k7k7k7k7 ) ripemd320( K7Kupps ) ripemd320( k7t4khpy ) ripemd320( k7vfF ) ripemd320( k7wp1fr2 ) ripemd320( k7xqw6grha ) ripemd320( K7zHyr9Z ) ripemd320( k814ph199rus ) ripemd320( k8229746 ) ripemd320( k82hxH ) ripemd320( k849693z ) ripemd320( k86P4gb ) ripemd320( k86p4gb8 ) ripemd320( k871436ab14 ) ripemd320( k8720105 ) ripemd320( k885424 ) ripemd320( k8858egn ) ripemd320( k88888888 ) ripemd320( K89521467k ) ripemd320( K89533910890A ) ripemd320( k8ai325b ) ripemd320( k8ehttfd ) ripemd320( K8FN941 ) ripemd320( k8h16dkb ) ripemd320( k8hLVIaZ ) ripemd320( k8isdhfio ) ripemd320( k8noon ) ripemd320( K8nteze ) ripemd320( k8pton ) ripemd320( k8qge5nQ9G ) ripemd320( k8r56 ) ripemd320( k8r8bx54 ) ripemd320( k8ryu45u ) ripemd320( k8t2nq ) ripemd320( k8tie ) ripemd320( k8xh69l ) ripemd320( K8z8k3u ) ripemd320( k9011k ) ripemd320( k9022701611f ) ripemd320( k9031212 ) ripemd320( K9050863916 ) ripemd320( K9092465a ) ripemd320( K92363 ) ripemd320( k92gjdftyv ) ripemd320( k95227 ) ripemd320( k9596 ) ripemd320( k966916 ) ripemd320( k96948 ) ripemd320( k9782902 ) ripemd320( k987654 ) ripemd320( k9baz9 ) ripemd320( k9dE8d ) ripemd320( k9dls02a ) ripemd320( k9edu ) ripemd320( k9et35rh ) ripemd320( k9ight ) ripemd320( k9k9k9 ) ripemd320( k9l7er ) ripemd320( k9nine ) ripemd320( K9OgAHCoD7 ) ripemd320( k9r3o7t5 ) ripemd320( k9sextoy ) ripemd320( k9vV0soa ) ripemd320( k9vVos0a ) ripemd320( ka071089 ) ripemd320( ka0bsl ) ripemd320( ka101010 ) ripemd320( ka1111 ) ripemd320( ka1126 ) ripemd320( ka1226 ) ripemd320( ka123456 ) ripemd320( Ka123456 ) ripemd320( Ka12rm12 ) ripemd320( ka13om13 ) ripemd320( ka1402 ) ripemd320( ka1865 ) ripemd320( ka1980 ) ripemd320( ka1981 ) ripemd320( ka1985 ) ripemd320( ka1jjj ) ripemd320( ka1man ) ripemd320( ka1mkf ) ripemd320( ka1rio ) ripemd320( ka1ucu ) ripemd320( ka1yxedeky ) ripemd320( ka2500 ) ripemd320( ka284297 ) ripemd320( ka3tie ) ripemd320( ka4006 ) ripemd320( Ka447kdd ) ripemd320( ka4767 ) ripemd320( ka4ama ) ripemd320( ka4eliuk93 ) ripemd320( ka4orro1ak ) ripemd320( ka5gtm ) ripemd320( ka5ndr ) ripemd320( ka629741 ) ripemd320( ka6869 ) ripemd320( KA68xtmZLQHV ) ripemd320( ka6995 ) ripemd320( ka6bii ) ripemd320( Ka6CR884 ) ripemd320( ka6g ) ripemd320( ka7g ) ripemd320( ka7gvy ) ripemd320( ka7hwaZeM8C ) ripemd320( ka7V5c ) ripemd320( ka8575 ) ripemd320( ka881e ) ripemd320( ka8g ) ripemd320( ka8pwo ) ripemd320( KA974033 ) ripemd320( kaabakas ) ripemd320( kaajal ) ripemd320( kaal ) ripemd320( kaalalit ) ripemd320( kaalgat ) ripemd320( kaalikas ) ripemd320( kaalimato ) ripemd320( kaaliyah ) ripemd320( kaallen ) ripemd320( kaam ) ripemd320( kaamasut ) ripemd320( kaamel ) ripemd320( kaamis ) ripemd320( kaan ) ripemd320( kaan123 ) ripemd320( kaan199 ) ripemd320( kaankoc ) ripemd320( kaapoka155 ) ripemd320( kaapstad ) ripemd320( kaarde ) ripemd320( kaare0508 ) ripemd320( kaarel ) ripemd320( kaarina ) ripemd320( kaarlo ) ripemd320( kaas ) ripemd320( kaasbert ) ripemd320( kaasiku ) ripemd320( kaaskaas ) ripemd320( kaaskop ) ripemd320( kaategut ) ripemd320( kaatersk ) ripemd320( kaaterskil ) ripemd320( kaating ) ripemd320( KaatSomF ) ripemd320( kaawaa80 ) ripemd320( kab00m ) ripemd320( Kab18956 ) ripemd320( kab24475 ) ripemd320( kab6894 ) ripemd320( kaba ) ripemd320( kaba3 ) ripemd320( kabaal ) ripemd320( kababa ) ripemd320( kabachok ) ripemd320( kabaeva ) ripemd320( kabaeva17 ) ripemd320( kabak12 ) ripemd320( kabaka ) ripemd320( kabakaba ) ripemd320( kabal ) ripemd320( kabal1 ) ripemd320( kabal908 ) ripemd320( kabala ) ripemd320( kabalah ) ripemd320( kaball ) ripemd320( kaballah ) ripemd320( kabamo ) ripemd320( kaban ) ripemd320( kaban1 ) ripemd320( kaban12 ) ripemd320( kaban123 ) ripemd320( kaban124 ) ripemd320( kaban13 ) ripemd320( kaban18 ) ripemd320( kaban1959 ) ripemd320( kaban4505 ) ripemd320( kaban4eg ) ripemd320( kaban4ik ) ripemd320( kabana ) ripemd320( kabanchik ) ripemd320( KABANGA ) ripemd320( kabanhik ) ripemd320( kabanito ) ripemd320( kabanos ) ripemd320( kabanova ) ripemd320( kabarda ) ripemd320( kabarda07 ) ripemd320( kabardey ) ripemd320( kabardinka ) ripemd320( kabaret1 ) ripemd320( kabari ) ripemd320( kabasakal ) ripemd320( kabasik ) ripemd320( kabayo ) ripemd320( kabb7508 ) ripemd320( kabbala ) ripemd320( kabbalah ) ripemd320( kabc1 ) ripemd320( kabeer ) ripemd320( kabeljau ) ripemd320( kabelo ) ripemd320( kabelok ) ripemd320( kaberne ) ripemd320( kabers ) ripemd320( kabert ) ripemd320( kabibble ) ripemd320( kabij ) ripemd320( kabila ) ripemd320( kabinet ) ripemd320( kabiru ) ripemd320( kabkab ) ripemd320( kablam ) ripemd320( kablam01 ) ripemd320( kablamm0 ) ripemd320( kable ) ripemd320( kable469 ) ripemd320( kables ) ripemd320( kablooie ) ripemd320( kablor69 ) ripemd320( kabo ) ripemd320( kabo62 ) ripemd320( kabob ) ripemd320( kabong ) ripemd320( kaboo ) ripemd320( kaboobie ) ripemd320( kaboom ) ripemd320( Kaboom ) ripemd320( kaboom1 ) ripemd320( kaboom11 ) ripemd320( kabota ) ripemd320( kabouter ) ripemd320( Kabr2Ybc ) ripemd320( kabre906 ) ripemd320( kabreez ) ripemd320( kabriolet ) ripemd320( kabron ) ripemd320( kabsbe ) ripemd320( kabsk5zz ) ripemd320( kabtech ) ripemd320( kabubi ) ripemd320( kabucha ) ripemd320( kabuk ) ripemd320( kabuki ) ripemd320( Kabuki ) ripemd320( KABUKI ) ripemd320( kabuki1006 ) ripemd320( kabuki91 ) ripemd320( kabukisan ) ripemd320( kabul ) ripemd320( kabulong ) ripemd320( kabulova ) ripemd320( kabus69 ) ripemd320( kabuto ) ripemd320( kabutu ) ripemd320( kabyle ) ripemd320( kabylie ) ripemd320( kac43639 ) ripemd320( kaca1968 ) ripemd320( kacamata ) ripemd320( kacampbe ) ripemd320( kacang ) ripemd320( kacangijo ) ripemd320( kacannon ) ripemd320( kacav ) ripemd320( Kacdn ) ripemd320( kacenka ) ripemd320( kacey ) ripemd320( kacey1 ) ripemd320( kachan ) ripemd320( kachanov ) ripemd320( kacharava ) ripemd320( kacheek ) ripemd320( kachi ) ripemd320( kachimba ) ripemd320( kachina ) ripemd320( kaching ) ripemd320( kachkanar ) ripemd320( kachok ) ripemd320( kachoong ) ripemd320( kachur12 ) ripemd320( kachuraoleg ) ripemd320( kaci ) ripemd320( kaciccio ) ripemd320( kacie ) ripemd320( kaciuka ) ripemd320( kaciukas ) ripemd320( kacke ) ripemd320( kacken ) ripemd320( kacker ) ripemd320( kacnabroa ) ripemd320( kacpe ) ripemd320( kacper ) ripemd320( Kacper ) ripemd320( kacper06 ) ripemd320( kacper1 ) ripemd320( kacper12 ) ripemd320( kacper2 ) ripemd320( kacper7 ) ripemd320( kacperek ) ripemd320( kacperek1 ) ripemd320( kacqac ) ripemd320( kacsapicsa ) ripemd320( KACV9854 ) ripemd320( kacy ) ripemd320( kaczka ) ripemd320( Kaczka ) ripemd320( kaczmarek ) ripemd320( kaczor ) ripemd320( kaczor1 ) ripemd320( kaczorek ) ripemd320( kaczuszka1 ) ripemd320( kad123 ) ripemd320( kadaberado ) ripemd320( kadabra ) ripemd320( KADACH1991 ) ripemd320( kadafi ) ripemd320( kadakas ) ripemd320( kadal ) ripemd320( kadarius ) ripemd320( kadarka ) ripemd320( kadass ) ripemd320( kadastr ) ripemd320( kadath ) ripemd320( kaday113 ) ripemd320( kaddeem ) ripemd320( kaddel12 ) ripemd320( kade ) ripemd320( kadeem ) ripemd320( kadels ) ripemd320( kadem ) ripemd320( kaden ) ripemd320( kaden1 ) ripemd320( kaden123 ) ripemd320( kadena ) ripemd320( kadence ) ripemd320( kader ) ripemd320( kader1 ) ripemd320( kaderf ) ripemd320( kades ) ripemd320( kadeshan ) ripemd320( kadet ) ripemd320( kadet123 ) ripemd320( kadet2007 ) ripemd320( kadetka ) ripemd320( kadetova ) ripemd320( kadets ) ripemd320( kadett ) ripemd320( kadett16 ) ripemd320( kadewe ) ripemd320( kadi72 ) ripemd320( kadian ) ripemd320( kadiatou ) ripemd320( kadic1 ) ripemd320( kadiegir ) ripemd320( kadiha ) ripemd320( kadikoy ) ripemd320( kadila ) ripemd320( kadilak ) ripemd320( kadiloli ) ripemd320( kadin ) ripemd320( kadine ) ripemd320( kadir ) ripemd320( kadirbek ) ripemd320( kadirov ) ripemd320( kadj63 ) ripemd320( kadja ) ripemd320( kadkad ) ripemd320( kadlicjc ) ripemd320( kadman58 ) ripemd320( kadnikova ) ripemd320( kadogawa ) ripemd320( kados ) ripemd320( kadosh ) ripemd320( Kadosha ) ripemd320( kadri ) ripemd320( kadri1 ) ripemd320( kadri123 ) ripemd320( kadri2 ) ripemd320( kadriya ) ripemd320( kadrobv1 ) ripemd320( kadrovik ) ripemd320( kadstein ) ripemd320( kadukovalexey ) ripemd320( kaduna ) ripemd320( kadusend ) ripemd320( kady ) ripemd320( kadywy7o ) ripemd320( kadziewicz ) ripemd320( kae19861 ) ripemd320( kaeannadhyleantonette ) ripemd320( kaeb ) ripemd320( kaede ) ripemd320( kaefer ) ripemd320( kaefercg ) ripemd320( kaekj43 ) ripemd320( kael ) ripemd320( kael3476046 ) ripemd320( kael666 ) ripemd320( kaela ) ripemd320( kaela2 ) ripemd320( kaelah ) ripemd320( kaelani ) ripemd320( kaelee ) ripemd320( kaeleigh ) ripemd320( kaeli ) ripemd320( kaelin ) ripemd320( kaelin12 ) ripemd320( kaelin17 ) ripemd320( kaelkirjak ) ripemd320( kaelon ) ripemd320( kaelyn ) ripemd320( kaem ) ripemd320( kaemira ) ripemd320( kAEMsyR3 ) ripemd320( kaeo ) ripemd320( kaermorhen ) ripemd320( kaernten ) ripemd320( KaetaJ831 ) ripemd320( kaeto30 ) ripemd320( kaf01fee ) ripemd320( kaf07fee ) ripemd320( Kaf08fee ) ripemd320( kaf655 ) ripemd320( kafa2500 ) ripemd320( kafakafa ) ripemd320( kafali ) ripemd320( kafayin ) ripemd320( kafbf89b ) ripemd320( kafdurqo ) ripemd320( kafe ) ripemd320( kafedra ) ripemd320( kafeti ) ripemd320( kaffe ) ripemd320( Kaffe ) ripemd320( kaffe123 ) ripemd320( kaffee ) ripemd320( Kaffee ) ripemd320( kaffee01 ) ripemd320( kaffen ) ripemd320( kaffers ) ripemd320( kaffir ) ripemd320( kaffka ) ripemd320( kafji1 ) ripemd320( kafka ) ripemd320( kafka1 ) ripemd320( kafka123 ) ripemd320( kafka2 ) ripemd320( kafka42 ) ripemd320( kafka55 ) ripemd320( kafka9 ) ripemd320( kafkajay ) ripemd320( kafkas ) ripemd320( kaftan ) ripemd320( kaga ) ripemd320( kaga15 ) ripemd320( kagamaru ) ripemd320( kagamine ) ripemd320( kagamish ) ripemd320( kagato ) ripemd320( kagawa ) ripemd320( kage ) ripemd320( kage2k ) ripemd320( kagebunshin ) ripemd320( kagee ) ripemd320( kageman ) ripemd320( Kageman ) ripemd320( kagemand ) ripemd320( kagemane ) ripemd320( kagemusha ) ripemd320( kageone ) ripemd320( kager ) ripemd320( kagero ) ripemd320( kageyuki ) ripemd320( kagi8por ) ripemd320( kaglux9 ) ripemd320( kagoat ) ripemd320( kagom ) ripemd320( kagome ) ripemd320( kagome1234 ) ripemd320( kagor2 ) ripemd320( KaGtpa ) ripemd320( KaGTPA ) ripemd320( kagula ) ripemd320( kagura ) ripemd320( kagw6y ) ripemd320( kahakk ) ripemd320( kahal ) ripemd320( kahala ) ripemd320( kahala1 ) ripemd320( kahana ) ripemd320( kahanu ) ripemd320( kaheanm ) ripemd320( kaheksa ) ripemd320( kahel ) ripemd320( kaherne ) ripemd320( kahiko ) ripemd320( kahina ) ripemd320( kahitano ) ripemd320( kahla ) ripemd320( kahlan ) ripemd320( kahler ) ripemd320( kahless ) ripemd320( kahless1 ) ripemd320( kahlil ) ripemd320( kahlu ) ripemd320( kahlua ) ripemd320( kahlua00 ) ripemd320( kahn ) ripemd320( kahn101 ) ripemd320( kahn13 ) ripemd320( kahn4 ) ripemd320( kahn69 ) ripemd320( kahne9 ) ripemd320( kahoka ) ripemd320( kahoks ) ripemd320( kahoona ) ripemd320( kahoona5 ) ripemd320( kahouna ) ripemd320( kahraman1 ) ripemd320( kahramon ) ripemd320( kahrss ) ripemd320( kahuhipa ) ripemd320( kahul ) ripemd320( kahuna ) ripemd320( Kahuna ) ripemd320( KAHUNA ) ripemd320( kahuna1 ) ripemd320( Kahuna1 ) ripemd320( kahuna2 ) ripemd320( kahuna57 ) ripemd320( kahuna98 ) ripemd320( kahuna99 ) ripemd320( kahunajtmartin ) ripemd320( kahunapn ) ripemd320( kahur543 ) ripemd320( kahv00 ) ripemd320( kahvi ) ripemd320( kahvikuppi ) ripemd320( kahzinha ) ripemd320( kai1234 ) ripemd320( kai1487 ) ripemd320( kai1598 ) ripemd320( kai1es ) ripemd320( kai2001 ) ripemd320( kai2003 ) ripemd320( kai320 ) ripemd320( kai3404 ) ripemd320( kai5es ) ripemd320( kai8es ) ripemd320( kaia ) ripemd320( kaia123 ) ripemd320( kaiamor ) ripemd320( kaiaphoenix ) ripemd320( kaibab ) ripemd320( kaibigan ) ripemd320( kaibil ) ripemd320( kaichan ) ripemd320( kaichi ) ripemd320( kaid ) ripemd320( kaidan ) ripemd320( kaiden ) ripemd320( kaiden05 ) ripemd320( kaidi ) ripemd320( kai-dick ) ripemd320( kaidog19 ) ripemd320( kaidog41 ) ripemd320( kaidok ) ripemd320( kaientai ) ripemd320( kaifas ) ripemd320( kaifolov ) ripemd320( kaigoonj ) ripemd320( kaiha ) ripemd320( kaij320a ) ripemd320( kaijakat ) ripemd320( kaijaz ) ripemd320( kaiju ) ripemd320( kaijudos ) ripemd320( kaika ) ripemd320( kaikai ) ripemd320( kaikias ) ripemd320( kaikora ) ripemd320( kaikora1 ) ripemd320( kaikun ) ripemd320( kail19 ) ripemd320( kaila ) ripemd320( kailakat ) ripemd320( kailan ) ripemd320( kailani ) ripemd320( kailas ) ripemd320( kailasa ) ripemd320( kailash ) ripemd320( Kailash ) ripemd320( kailayu ) ripemd320( kaile ) ripemd320( kailee ) ripemd320( kailee1 ) ripemd320( kaileena ) ripemd320( kailey ) ripemd320( Kailey ) ripemd320( kailey1 ) ripemd320( kaili ) ripemd320( kailie ) ripemd320( kailin ) ripemd320( kailis ) ripemd320( kailord ) ripemd320( kailua ) ripemd320( kailum ) ripemd320( kaily ) ripemd320( kailyn ) ripemd320( Kailyn ) ripemd320( kaiman ) ripemd320( kaiman44 ) ripemd320( kaimana ) ripemd320( kaimei ) ripemd320( kaimen ) ripemd320( Kaimiloa ) ripemd320( kaimuki ) ripemd320( kain ) ripemd320( kain12 ) ripemd320( kain1492 ) ripemd320( kain23 ) ripemd320( kain2k ) ripemd320( kain2k2k ) ripemd320( kain48 ) ripemd320( kain666 ) ripemd320( kainalu ) ripemd320( kaine ) ripemd320( kaine1 ) ripemd320( kaine4 ) ripemd320( kainen ) ripemd320( kaines ) ripemd320( kaini ) ripemd320( kainkain ) ripemd320( kainkey8 ) ripemd320( kainlost ) ripemd320( kainoa ) ripemd320( kainov13 ) ripemd320( kainry )
How To Spoof PDF Signatures
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not trusted" warning shown by the viewer - and asked ourselfs:
"How do PDF signatures exactly work?"
We are quite familiar with the security of message formats like XML and JSON. But nobody had an idea, how PDFs really work. So we started our research journey.
Today, we are happy to announce our results. In this blog post, we give an overview how PDF signatures work and on top, we reveal three novel attack classes for spoofing a digitally signed PDF document. We present our evaluation of 22 different PDF viewers and show 21 of them to be vulnerable. We additionally evaluated 8 online validation services and found 6 to be vulnerable.
In cooperation with the BSI-CERT, we contacted all vendors, provided proof-of-concept exploits, and helped them to fix the issues and three generic CVEs for each attack class were issued: CVE-2018-16042, CVE-2018-18688, CVE-2018-18689.
Full results are available in the master thesis of Karsten Meyer zu Selhausen, in our security report, and on our website.
In fact, you may have already used them.
Have you ever opened an Invoice by companies such as Amazon, Sixt, or Decathlon?
These PDFs are digitally signed and protected against modifications.
In fact, PDF signatures are widely deployed in our world. In 2000, President Bill Clinton enacted a federal law facilitating the use of electronic and digital signatures in interstate and foreign commerce by ensuring the validity and legal effect of contracts. He approved the eSign Act by digitally signing it.
Since 2014, organizations delivering public digital services in an EU member state are required to support digitally signed documents, which are even admissible as evidence in legal proceedings.
In Austria, every governmental authority digitally signs any official document [§19]. In addition, any new law is legally valid after its announcement within a digitally signed PDF.
Several countries like Brazil, Canada, the Russian Federation, and Japan also use and accept digitally signed documents.
According to Adobe Sign, the company processed 8 billion electronic and digital signatures in the 2017 alone.
PDF files are ASCII files. You can use a common text editor to open them and read the source code.
PDF Signatures rely on a feature of the PDF specification called incremental saving (also known as incremental update), allowing the modification of a PDF file without changing the previous content.
As you can see in the figure on the left side, the original document is the same document as the one described above. By signing the document, an incremental saving is applied and the following content is added: a new Catalog, a Signature object, a new Xref table referencing the new object(s), and a new Trailer. The new Catalog extends the old one by adding a reference to the Signature object. The Signature object (5 0 obj) contains information regarding the applied cryptographic algorithms for hashing and signing the document. It additionally includes a Contents parameter containing a hex-encoded PKCS7 blob, which holds the certificates as well as the signature value created with the private key corresponding to the public key stored in the certificate. The ByteRange parameter defines which bytes of the PDF file are used as the hash input for the signature calculation and defines 2 integer tuples:
a, b : Beginning at byte offset a, the following b bytes are used as the first input for the hash calculation. Typically, a 0 is used to indicate that the beginning of the file is used while a b is the byte offset where the PKCS#7 blob begins.
c, d : Typically, byte offset c is the end of the PKCS#7 blob, while c d points to the last byte range of the PDF file and is used as the second input to the hash calculation.
In this blog post, we give an overview on the attacks without going into technical details. If you are more interested, just take a look at the sources we summarized for you here.
Instead of treating the missing information as an error, it shows that the contained signature is valid. For example, the attacker can manipulate the Contents or ByteRange values within the Signature object. The manipulation of these entries is reasoned by the fact that we either remove the signature value or the information stating which content is signed.
The attack seems trivial, but even very good implementations like Adobe Reader DC preventing all other attacks were susceptible against USF.
The Incremental Saving Attack (ISA) abuses a legitimate feature of the PDF specification, which allows to update a PDF file by appending the changes. The feature is used, for example, to store PDF annotations, or to add new pages while editing the file.
The main idea of the ISA is to use the same technique for changing elements, such as texts, or whole pages included in the signed PDF file to what the attacker desires.
In other words, an attacker can redefine the document's structure and content using the Body Updates part. The digital signature within the PDF file protects precisely the part of the file defined in the ByteRange. Since the incremental saving appends the Body Updates to the end of the file, it is not part of the defined ByteRange and thus not part of the signature's integrity protection. Summarized, the signature remains valid, while the Body Updates changed the displayed content.
This is not forbidden by the PDF specification, but the signature validation should indicate that the document has been altered after signing.
In PDF files, SWA targets the signature validation logic by relocating the originally signed content to a different position within the document and inserting new content at the allocated position. The starting point for the attack is the manipulation of the ByteRange value allowing to shift the signed content to different loctions within the file.
On a very technical level, the attacker uses a validly signed document (shown on the left side) and proceeds as follows:
Christian Mainka
Karsten Meyer zu Selhausen
Martin Grothe
Jörg Schwenk
We also want to acknowledge the teams which reacted to our report and fixed the vulnerable implementations.
"How do PDF signatures exactly work?"
We are quite familiar with the security of message formats like XML and JSON. But nobody had an idea, how PDFs really work. So we started our research journey.
Today, we are happy to announce our results. In this blog post, we give an overview how PDF signatures work and on top, we reveal three novel attack classes for spoofing a digitally signed PDF document. We present our evaluation of 22 different PDF viewers and show 21 of them to be vulnerable. We additionally evaluated 8 online validation services and found 6 to be vulnerable.
In cooperation with the BSI-CERT, we contacted all vendors, provided proof-of-concept exploits, and helped them to fix the issues and three generic CVEs for each attack class were issued: CVE-2018-16042, CVE-2018-18688, CVE-2018-18689.
Full results are available in the master thesis of Karsten Meyer zu Selhausen, in our security report, and on our website.
Digitally Signed PDFs? Who the Hell uses this?
Maybe you asked yourself, if signed PDFs are important and who uses them.In fact, you may have already used them.
Have you ever opened an Invoice by companies such as Amazon, Sixt, or Decathlon?
These PDFs are digitally signed and protected against modifications.
In fact, PDF signatures are widely deployed in our world. In 2000, President Bill Clinton enacted a federal law facilitating the use of electronic and digital signatures in interstate and foreign commerce by ensuring the validity and legal effect of contracts. He approved the eSign Act by digitally signing it.
Since 2014, organizations delivering public digital services in an EU member state are required to support digitally signed documents, which are even admissible as evidence in legal proceedings.
In Austria, every governmental authority digitally signs any official document [§19]. In addition, any new law is legally valid after its announcement within a digitally signed PDF.
Several countries like Brazil, Canada, the Russian Federation, and Japan also use and accept digitally signed documents.
According to Adobe Sign, the company processed 8 billion electronic and digital signatures in the 2017 alone.
Crash Course: PDF and PDF Signatures
To understand how to spoof PDF Signatures, we unfortunately need to explain the basics first. So here is a breef overview.PDF files are ASCII files. You can use a common text editor to open them and read the source code.
PDF header. The header is the first line within a PDF and defines the interpreter version to be used. The provided example uses version PDF 1.7.
PDF body. The body defines the content of the PDF and contains text blocks, fonts, images, and metadata regarding the file itself. The main building blocks within the body are objects. Each object starts with an object number followed by a generation number. The generation number should be incremented if additional changes are made to the object.
In the given example, the Body contains four objects: Catalog, Pages, Page, and stream. The Catalog object is the root object of the PDF file. It defines the document structure and can additionally declare access permissions. The Catalog refers to a Pages object which defines the number of the pages and a reference to each Page object (e.g., text columns). The Page object contains information how to build a single page. In the given example, it only contains a single string object "Hello World!".
Xref table. The Xref table contains information about the position (byte offset) of all PDF objects within the file.
Trailer. After a PDF file is read into memory, it is processed from the end to the beginning. By this means, the Trailer is the first processed content of a PDF file. It contains references to the Catalog and the Xref table.
How do PDF Signatures work?
As you can see in the figure on the left side, the original document is the same document as the one described above. By signing the document, an incremental saving is applied and the following content is added: a new Catalog, a Signature object, a new Xref table referencing the new object(s), and a new Trailer. The new Catalog extends the old one by adding a reference to the Signature object. The Signature object (5 0 obj) contains information regarding the applied cryptographic algorithms for hashing and signing the document. It additionally includes a Contents parameter containing a hex-encoded PKCS7 blob, which holds the certificates as well as the signature value created with the private key corresponding to the public key stored in the certificate. The ByteRange parameter defines which bytes of the PDF file are used as the hash input for the signature calculation and defines 2 integer tuples:
a, b : Beginning at byte offset a, the following b bytes are used as the first input for the hash calculation. Typically, a 0 is used to indicate that the beginning of the file is used while a b is the byte offset where the PKCS#7 blob begins.
c, d : Typically, byte offset c is the end of the PKCS#7 blob, while c d points to the last byte range of the PDF file and is used as the second input to the hash calculation.
Attacks
During our research, we discovered three novel attack classes on PDF signatures:- Universal Signature Forgery (USF)
- Incremental Saving Attack (ISA)
- Signature Wrapping Attack (SWA)
In this blog post, we give an overview on the attacks without going into technical details. If you are more interested, just take a look at the sources we summarized for you here.
Universal Signature Forgery (USF)
The main idea of Universal Signature Forgery (USF) is to manipulate the meta information in the signature in such a way that the targeted viewer application opens the PDF file, finds the signature, but is unable to find all necessary data for its validation.Instead of treating the missing information as an error, it shows that the contained signature is valid. For example, the attacker can manipulate the Contents or ByteRange values within the Signature object. The manipulation of these entries is reasoned by the fact that we either remove the signature value or the information stating which content is signed.
The attack seems trivial, but even very good implementations like Adobe Reader DC preventing all other attacks were susceptible against USF.
Incremental Saving Attack (ISA)
The Incremental Saving Attack (ISA) abuses a legitimate feature of the PDF specification, which allows to update a PDF file by appending the changes. The feature is used, for example, to store PDF annotations, or to add new pages while editing the file.
The main idea of the ISA is to use the same technique for changing elements, such as texts, or whole pages included in the signed PDF file to what the attacker desires.
In other words, an attacker can redefine the document's structure and content using the Body Updates part. The digital signature within the PDF file protects precisely the part of the file defined in the ByteRange. Since the incremental saving appends the Body Updates to the end of the file, it is not part of the defined ByteRange and thus not part of the signature's integrity protection. Summarized, the signature remains valid, while the Body Updates changed the displayed content.
This is not forbidden by the PDF specification, but the signature validation should indicate that the document has been altered after signing.
Signature Wrapping Attack (SWA)
Independently of the PDFs, the main idea behind Signature Wrapping Attacks is to force the verification logic to process different data than the application logic.In PDF files, SWA targets the signature validation logic by relocating the originally signed content to a different position within the document and inserting new content at the allocated position. The starting point for the attack is the manipulation of the ByteRange value allowing to shift the signed content to different loctions within the file.
On a very technical level, the attacker uses a validly signed document (shown on the left side) and proceeds as follows:
- Step 1 (optional): The attacker deletes the padded zero Bytes within the Contents parameter to increase the available space for injecting manipulated objects.
- Step 2: The attacker defines a new /ByteRange [a b c* d] by manipulating the c value, which now points to the second signed part placed on a different position within the document.
- Step 3: The attacker creates a new Xref table pointing to the new objects. It is essential that the byte offset of the newly inserted Xref table has the same byte offset as the previous Xref table. The position is not changeable since it is refer- enced by the signed Trailer. For this purpose, the attacker can add a padding block (e.g., using whitespaces) before the new Xref table to fill the unused space.
- Step 4: The attacker injects malicious objects which are not protected by the signature. There are different injection points for these objects. They can be placed before or after the malicious Xref table. If Step 1 is not executed, it is only possible to place them after the malicious Xref table.
- Step 5 (optional): Some PDF viewers need a Trailer after the manipulated Xref table, otherwise they cannot open the PDF file or detect the manipulation and display a warning message. Copying the last Trailer is sufficient to bypass this limitation.
- Step 6: The attacker moves the signed content defined by c and d at byte offset c*. Optionally, the moved content can be encapsulated within a stream object. Noteworthy is the fact that the manipulated PDF file does not end with %%EOF after the endstream. The reason why some validators throw a warning that the file was manipulated after signing is because of an %%EOF after the signed one. To bypass this requirement, the PDF file is not correctly closed. However, it will be still processed by any viewer.
Evaluation
In our evaluation, we searched for desktop applications validating digitally signed PDF files. We analyzed the security of their signature validation process against our 3 attack classes. The 22 applications fulfill these requirements. We evaluated the latest versions of the applications on all supported platforms (Windows, MacOS, and Linux).Authors of this Post
Vladislav MladenovChristian Mainka
Karsten Meyer zu Selhausen
Martin Grothe
Jörg Schwenk
Acknowledgements
Many thanks to the CERT-Bund team for the great support during the responsible disclosure.We also want to acknowledge the teams which reacted to our report and fixed the vulnerable implementations.
More information
- Bluetooth Hacking Tools Kali
- Hacking Tools Github
- Hack Tools Mac
- Ethical Hacker Tools
- Hacking Tools For Pc
- Pentest Tools Online
- Hacks And Tools
- Pentest Tools For Windows
- Hacking Tools Pc
- Hacker Tools List
- Pentest Tools Windows
- Free Pentest Tools For Windows
- Android Hack Tools Github
- Hacker Tools Apk Download
- Hacker Tools Github
- Hacker Tools For Ios
- Hacker Tools
- Hack And Tools
- Pentest Tools Github
- Hak5 Tools
- Hacker Tools Apk Download
- Hacker Tools For Ios
- Easy Hack Tools
- Hacking Tools For Windows 7
- Kik Hack Tools
- Hacking Tools For Windows
- Pentest Tools Tcp Port Scanner
- Pentest Tools For Android
- Hack Rom Tools
- Pentest Tools List
- Pentest Recon Tools
- Hack Apps
- What Is Hacking Tools
- Pentest Tools Alternative
- Hacking Tools Pc
- Tools For Hacker
- Hacking Tools Hardware
- Pentest Tools
- Pentest Tools Bluekeep
- Pentest Tools Download
- Hack Tool Apk No Root
- Pentest Tools Open Source
- Pentest Tools For Ubuntu
- Pentest Tools Nmap
- Hacking Tools For Beginners
- Hacker Tools For Ios
- Hacking Tools For Beginners
- Hacking Tools For Windows 7
- Pentest Tools Website
- Free Pentest Tools For Windows
- Bluetooth Hacking Tools Kali
- Hacking Tools Name
- Hack Tools Pc
- Bluetooth Hacking Tools Kali
- Android Hack Tools Github
- Hacking App
- Hacking App
- Hacker Tools 2019
- Hacking Tools Free Download
- Hacking Tools Windows 10
- Pentest Reporting Tools
- Easy Hack Tools
- Hack Apps
- Kik Hack Tools
- Ethical Hacker Tools
- Pentest Tools Find Subdomains
- Pentest Automation Tools
- Pentest Tools Website
- Pentest Tools For Windows
- Tools For Hacker
- Termux Hacking Tools 2019
- Hack Tools Online
- Hacking Tools Name
- Pentest Tools Download
- Hack Tools 2019
- Hacker Hardware Tools
- Hacker Tools Software
- Physical Pentest Tools
- Hackers Toolbox
- Ethical Hacker Tools
- Hack Website Online Tool
- Blackhat Hacker Tools
- How To Make Hacking Tools
- Hacker Search Tools
- Android Hack Tools Github
- What Are Hacking Tools
- Pentest Tools For Android
- Pentest Tools Windows
- Pentest Tools Tcp Port Scanner
- Hack Tools For Pc
- Hack Tools
- Hackrf Tools
- Hacking Tools Usb
- Pentest Tools Kali Linux
- World No 1 Hacker Software
- Pentest Tools Find Subdomains
- Pentest Box Tools Download
- Pentest Tools Website
- Hacker Hardware Tools
- Pentest Tools For Android
- Hacker Tools Free
- Hack Tools For Games
- Pentest Tools Port Scanner
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Windows 10
- Pentest Tools Free
- Hacking Tools Name
- Android Hack Tools Github
- Hacker Tools List
- Hacker Tools Mac
- Hack Tools Download
- Tools 4 Hack
- Pentest Tools Windows
- Hack Tool Apk No Root
- Pentest Tools Github
- Tools For Hacker
- Best Hacking Tools 2020
- Pentest Tools
- Hacking Tools Usb
- Pentest Tools Find Subdomains
- Pentest Tools Website
- Hacker Tools 2020
- Hacker Tools Free Download
- Hacker Tools Free
- Hacker Tools 2019
- What Are Hacking Tools
- Easy Hack Tools
- Hacker Tools Linux
- Hack Tools Mac
- Pentest Tools Github
- Computer Hacker
- Hack Rom Tools
- Hackrf Tools
- Hack Tools For Games
- Hacking Tools
- Hacking Tools For Windows 7
- Hack Tools
- Pentest Tools Port Scanner
- Hackers Toolbox
- Best Pentesting Tools 2018
- Best Pentesting Tools 2018
- Hacker Tools Mac
- Pentest Tools Subdomain
- Computer Hacker
- Termux Hacking Tools 2019
- Hack Apps
- Hacker Tools Github
- Pentest Tools Url Fuzzer
- Hack And Tools
- Hacking Tools Hardware
- Pentest Reporting Tools
- Hacking Tools
- Hak5 Tools
- Hacker Tools Github
- Pentest Tools Download
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Free Download
- What Are Hacking Tools
Suscribirse a:
Entradas (Atom)