Safe PDF documents – Project LapisCategories
Course & option:
Diploma in Infocomm Security Management
Safe PDF documents – Project Lapis
Daniel Ho Jing Yang, Lindon Ng Kah Wer, Muhammad Mikail Bin Jamil, Yew Jing Hui
Ho Chee Meng (firstname.lastname@example.org)
External Supervisor (DSO):
Yap Chun Beng (email@example.com)
Koh Ming Yang (firstname.lastname@example.org)
Python 2.7, Adobe PDF format
The Adobe Portable Document Format has passed the test of time, to be the world’s de facto standard format when an electronic “hard copy” document is required. A programming language in its own rights, the format is committed to document handling and control, garnering a wealth of powerful features with every new version.
In protected networks where documents with complex formats such as PDF are used, they can be used as a medium for malware or for data leakage. For example, in 2014, Adobe Reader had 67 vulnerabilities, and 31% of them still remain unpatched today. Sensitive information can also be hidden in PDF files as a means to leak them out through sensitive networks.
The purpose of project Lapis is to develop a competent backend application to analyse and sanitise PDF files, for use as a first line of defence in a series of anti-virus solutions, to increase productivity and optimise the flow of documents.
The tool chain application, Lapis, was created with the intention to improve the process of handling PDF files by acting as the first respondent. Commercial Anti-virus solutions, though effective, tend to impede the flow of processing documents.
Lapis, if part of a chain of solutions, aims to reduce the overhead of documents being parsed through by filtering out suspicious or malicious files. Dynamic analysis software can then be employed to analyse the flagged suspicious files.
Lapis as a single entity, is a comprehensive stand-alone tool for the static analysis of PDF documents, which provides two levels of sanitisation options to users.
Lapis can function as a modular attachment to an existing chain of security measures with the specific role of parsing any PDF documents that are being imported into the system or exported out.
To cater to the general public, Lapis is able to be used as a stand-alone tool. By deploying it as a web application, Lapis is able to function as an online scanning tool.