The PDF: Frozen PostScript, Honor System Passwords, and Zip Bombs

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In the early 1990s a formatted document sent from one computer to another often arrived scrambled, with shifted paragraphs, broken fonts, and missing images. In 1991 Adobe co-founder John Warnock launched the Camelot Project to fix that with a simplified form of PostScript, the page description language Adobe had built for printers. The result was the Portable Document Format, released as a free specification in 1993 and made an open ISO standard in 2008.

This episode opens the container. PostScript is a full programming language that a printer had to run from start to finish, so one error meant resending the whole job. A PDF freezes that program into static data, isolates each page, and stores everything as objects in a tree. A cross-reference table near the end of the file gives the exact byte offset of each object, which is why page 800 of a huge manual opens instantly. The same layered structure also gives attackers places to hide.

• Linearized, or web-optimized, PDFs place everything needed for the first page at the start of the file, so a browser can show page one while the rest downloads.
• Fourteen standard fonts, including Times, Courier, Helvetica, Symbol, and Zapf Dingbats, were expected in every reader. Any other font must be embedded or the viewer will substitute its own.
• A user password truly encrypts a PDF. An owner password that blocks printing or copying encrypts nothing and depends on the reader software choosing to obey it.
• In 2019 researchers at Ruhr University Bochum showed shadow attacks that abuse incremental updates to change the visible content of a digitally signed PDF without invalidating the signature.
• Nested compression filters make zip bombs possible: a file of about five kilobytes can expand toward a petabyte in memory and crash the machine that opens it.