Can somebody make a tool to inject Information into a PDF? - Page 2

pdfcrack · 07-10-2006, 02:27 PM

Hello, thought I might pitch in with some information as I have worked with the pdf-security-scheme.

CommanderROR: You are correct that you are stuck with bad compatibility or bad protection. If someone can access the content they can also create a new pdf with the same content but without the protection rather easily.
Owner-password does not give ANY protection from this in the current scheme and as I stated above it is quite clear that it cannot provide any protection as long as the user can access the content.
The only protection that works is to give only users that you trust access to the content and even then, these users may extract the content that they have access to and produce a copy without protection.

A scheme that might work in the future is to have hardware DRM that remove a user the right to do what they want with their computer and by that enforcing the restrictions you set, but, as always we have the analog hole even then and you can always (it might be more or less hard though) reproduce the content manually by creating a completly new copy.

Current PDF-files are really quite easy to break if you know the user-password or if it is unencrypted. If the user-password is null and the document unencrypted it is as easy as recalculating the checksum that it is matched to with the new permission you want to set. If the document is encrypted with null-password, all you need to do is to decrypt and write back the unencrypted information and then recalculate the checksum (and possible the file-offsets), and if you have a userpassword that the user have access to or manages to crack you can rather easily unencrypt and then do the above (and maybe recalculate the checksum).
Instead of recalculating the checksum you might remove the encryption-object in the trailer alltogther.

yokos · 07-12-2006, 10:04 AM

# In Acrobat you can "signature" a pdf file. This way you can limit the rights too. Not all software decrypters can handle this.

bingle · 07-12-2006, 01:56 PM

Here's a message I wrote on TeleRead about your DRM scheme, CommanderROR... I decided to post it here, too, since we're talking about the same thing ;-)

Roland:

I'm not convinced that personal watermark-style DRM is a good idea. For one thing, there are a number of technical issues with implementation, as in any DRM scheme. Ed Felten talks about that on his Freedom to Tinker blog (http://www.freedom-to-tinker.com/?p=981).

However, even if it works, I question whether we want it to work. One of the problems with DRM is that it prevents legitimate fair use of content. If DRM prevents the owner from doing something legal with the content that they would otherwise be able to do with a print book, it is a failure, in my opinion. (Not to get sidetracked, but I really believe that limiting digital books to be exactly as bad as print books is a terrible rejection of their promise).

So, with a watermarked piece of content, the owner will not share it on P2P networks. But she will also not share it with friends, family, or neighbors - she might trust them, but if they share it with someone else, or accidentally leave it in the wrong folder, or any number of other scenarios take place, the content with her personal information is all over the Internet. Leaving her wide open to accusations of criminal activity, not to mention exposure of private details.

There's also excerpting - if a content owner wants to put a snippet of the work in an article or a paper. She is then not only publishing the quoted information, but also potentially her home address, account details, or whatever other personal information the watermark contains. This not only makes it impossible to write anonymous works that quote watermarked material, it would make any author think twice about publishing works that contain quoted material freely.

Another objection is touched upon by Kathryn Cramer on her blog (http://www.kathryncramer.com/kathryn...arking_as.html), and points out that watermarking could potentially harm small content creators (as many DRM schemes do).

There are good features to watermarking, certainly, but I don't think it's the perfect solution by any means.

CommanderROR · 07-12-2006, 04:39 PM

You are right.
The whole "personal information DRM" is not perfect, but it was an idea that might work better than the current scheme and everything is worth a try.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
eBook PDF - free tool for creating PDF eBooks from text files	KACartlidge	PDF	6	01-04-2012 09:41 AM

07-10-2006, 02:27 PM	#16
pdfcrack Junior Member Posts: 1 Karma: 10 Join Date: Jul 2006	Hello, thought I might pitch in with some information as I have worked with the pdf-security-scheme. CommanderROR: You are correct that you are stuck with bad compatibility or bad protection. If someone can access the content they can also create a new pdf with the same content but without the protection rather easily. Owner-password does not give ANY protection from this in the current scheme and as I stated above it is quite clear that it cannot provide any protection as long as the user can access the content. The only protection that works is to give only users that you trust access to the content and even then, these users may extract the content that they have access to and produce a copy without protection. A scheme that might work in the future is to have hardware DRM that remove a user the right to do what they want with their computer and by that enforcing the restrictions you set, but, as always we have the analog hole even then and you can always (it might be more or less hard though) reproduce the content manually by creating a completly new copy. Current PDF-files are really quite easy to break if you know the user-password or if it is unencrypted. If the user-password is null and the document unencrypted it is as easy as recalculating the checksum that it is matched to with the new permission you want to set. If the document is encrypted with null-password, all you need to do is to decrypt and write back the unencrypted information and then recalculate the checksum (and possible the file-offsets), and if you have a userpassword that the user have access to or manages to crack you can rather easily unencrypt and then do the above (and maybe recalculate the checksum). Instead of recalculating the checksum you might remove the encryption-object in the trailer alltogther.

07-12-2006, 10:04 AM	#17
yokos Pac-Man caught my iLiad. Posts: 807 Karma: 3595 Join Date: Apr 2006 Location: Germany; next to Baltic Sea Device: Boox Max Lumi, iRex iLiad (RIP)	# In Acrobat you can "signature" a pdf file. This way you can limit the rights too. Not all software decrypters can handle this.

07-12-2006, 01:56 PM	#18
bingle Addict Posts: 273 Karma: 499 Join Date: Nov 2005 Location: San Francisco Device: Sony Reader	Here's a message I wrote on TeleRead about your DRM scheme, CommanderROR... I decided to post it here, too, since we're talking about the same thing ;-) Roland: I'm not convinced that personal watermark-style DRM is a good idea. For one thing, there are a number of technical issues with implementation, as in any DRM scheme. Ed Felten talks about that on his Freedom to Tinker blog (http://www.freedom-to-tinker.com/?p=981). However, even if it works, I question whether we want it to work. One of the problems with DRM is that it prevents legitimate fair use of content. If DRM prevents the owner from doing something legal with the content that they would otherwise be able to do with a print book, it is a failure, in my opinion. (Not to get sidetracked, but I really believe that limiting digital books to be exactly as bad as print books is a terrible rejection of their promise). So, with a watermarked piece of content, the owner will not share it on P2P networks. But she will also not share it with friends, family, or neighbors - she might trust them, but if they share it with someone else, or accidentally leave it in the wrong folder, or any number of other scenarios take place, the content with her personal information is all over the Internet. Leaving her wide open to accusations of criminal activity, not to mention exposure of private details. There's also excerpting - if a content owner wants to put a snippet of the work in an article or a paper. She is then not only publishing the quoted information, but also potentially her home address, account details, or whatever other personal information the watermark contains. This not only makes it impossible to write anonymous works that quote watermarked material, it would make any author think twice about publishing works that contain quoted material freely. Another objection is touched upon by Kathryn Cramer on her blog (http://www.kathryncramer.com/kathryn...arking_as.html), and points out that watermarking could potentially harm small content creators (as many DRM schemes do). There are good features to watermarking, certainly, but I don't think it's the perfect solution by any means.

07-12-2006, 04:39 PM	#19
CommanderROR eink fanatic Posts: 2,022 Karma: 4924 Join Date: Mar 2006 Location: Germany Device: STAReBOOK, iRex Iliad, Sony 505, Kindle 2	You are right. The whole "personal information DRM" is not perfect, but it was an idea that might work better than the current scheme and everything is worth a try.