To test if our attacks can bypass your signature validation and/or your application logic, you can download the provided PoCs from our website and open the files. How to test your application/library/service No, we only analyzed signatures in standard PDF version 1.7, without standards like PDF/A.

Did you analyze other standards than PDF? For example, the validation of a signed pdf can be executed with different calls in pdfbox. To this point, we did not analyze PDF libraries like poppler (pdfsig) or pdfbox, since different configurations are possible. In the first phase of our security evaluation we concentrated on pdf viewers and online validation services, since they give a clear indication wether the attack was successful. *according to vendor's website, not manually verified! Where are the PDF libraries? It is licensed under the Creative Commons and free for any use. You can use the following logo for the PDFex attacks. We analyzed all PDF applications, which we could identity for signature support. PDF Signatures FAQ Why did you not analyze Viewer X We only analyzed PDF Viewer Software (see our list). PDF Encryption FAQ Did we test Email/Encryption Gateways, Medical Products, or Printer/Fax devices against PDFex?

Sumatra pdf printer