The illusion of security is worse than the awareness of its absence because it leads to decisions made on false premises. Information conveyed by public trust institutions such as “We protect your personal data” often creates this illusion of security. Let’s study two examples of this using password-protected PDF files.
- I received an email from PZU with an insurance offer, emphasizing “We protect personal data”:
2. The attachment was a PDF file protected by a password:
3. Let’s assume I don’t know the password. However, I know from the email content that the password consists of 4 digits. Let’s check how long it will take to crack it using a modern home computer.
4. By opening the PDF in text mode, we can read the file header (e.g., using Notepad). This will allow us to identify which version of the standard it was created in:
5. The next step is to extract the password hash we want to crack. Here, the tool pdf2john.py comes in handy.
6. To crack the obtained hash, we will use hashcat in brute force mode. 10500 indicates the hash cracking mode for PDF files in versions 1.4-1.6:
As seen below, cracking a four-digit password took 10 seconds:
Therefore, it can be confidently stated that a 4-digit password is a type of illusory protection and does not secure personal data.
Next, let’s examine the “secured” PDF from NN Investment Partners.
- Here, it was “protected” with a slightly longer string of characters — the PESEL number.
2. The file header in the attachment – “%PDF-1.2” indicates that the file was created using the 1996 standard:
3. The extracted password hash indicates the same:
4. We run a “brute” brute force with hashcat. “Brute” because we do not consider any additional assumptions that would reduce the number of possible combinations except that the PESEL is an 11-digit number:
What to do, how to live?
To encrypt data, long passwords should be used — over 12 characters, with a large character space, i.e., containing uppercase/lowercase letters, digits, and special characters. Such a password should be sent to the client through a second communication channel, such as SMS. Additionally, institutions should use strong encryption algorithms that significantly slow down brute force attempts. An example here could be using a 7zip archive with the AES-256 algorithm.
