Can PDFs contain resources that are loaded from the internet

internetpdf

I found this information on the Tor website:

You should be very careful when downloading documents via Tor
(especially DOC and PDF files) as these documents can contain Internet
resources that will be downloaded outside of Tor by the application
that opens them. This will reveal your non-Tor IP address. If you must
work with DOC and/or PDF files, we strongly recommend either using a
disconnected computer, downloading the free VirtualBox and using it
with a virtual machine image with networking disabled, or using Tails.
Under no circumstances is it safe to use BitTorrent and Tor together,
however.

Images can not be embedded from an external source as far as I know. So which resources are meant?

Best Answer

  • I think the key to your question is that can you embed JavaScipt in a PDF. And this article seems to explain that process: “How to enhance your PDF forms with JavaScript”

    So you could embed some code that connects to an external server to exchange data between the outside and your PC.

    I am not sure if there are in-built security options that limit whether a pdf file can “call home.” Perhaps this also depends on the PDF reader that is being used.

    EDIT:

    To check the settings in Adobe Reader hit ctrl-k and select Trust manager on the left hand side. This shows the following options on my version:

    Adobe Trust Manager settings

    You can provide detail which websites you deem acceptable for a pdf to contact. Also, again on the left hand side, click on JavaScript, where you can turn the use of Adobe JavaScript on or off.

    As per mgutt's comment below, I couldn't see why you shouldn't be able to use app.media.getURLData() to load external data if JavaScript, no other restrictions are set and of course the pdf application supports JavaScript.

  • Related Question