Story Beyond the Eye: Glyph Positions Break PDF Text Redaction

TL;DR

This paper reveals that many PDF redactions are insecure due to character positioning leaks, allowing the recovery of redacted information, and provides open-source fixes and notifications to relevant organizations.

Contribution

It uncovers a vulnerability in common PDF redactions caused by character positioning and offers open-source algorithms to improve redaction security.

Findings

Many redactions leak character position information

Redacted text can be effectively recovered in real-world PDFs

Open source tools can mitigate the leakage

Abstract

In this work we find that many current redactions of PDF text are insecure due to non-redacted character positioning information. In particular, subpixel-sized horizontal shifts in redacted and non-redacted characters can be recovered and used to effectively deredact first and last names. Unfortunately these findings affect redactions where the text underneath the black box is removed from the PDF. We demonstrate these findings by performing a comprehensive vulnerability assessment of common PDF redaction types. We examine 11 popular PDF redaction tools, including Adobe Acrobat, and find that they leak information about redacted text. We also effectively deredact hundreds of real-world PDF redactions, including those found in OIG investigation reports and FOIA responses. To correct the problem, we have released open source algorithms to fix trivial redactions and reduce the amount of information leaked by nonexcising redactions (where the text underneath the redaction is copy-pastable). We have also notified the developers of the studied redaction tools. We have notified the Office of Inspector General, the Free Law Project, PACER, Adobe, Microsoft, and the US Department of Justice. We are working with several of these groups to prevent our discoveries from being used for malicious purposes.