Story Beyond the Eye: Glyph Positions Break PDF Text Redaction

Abstract

In this work we find that many current redactions of PDF text are insecure due to non-redacted character positioning information. In particular, subpixel-sized horizontal shifts in redacted and non-redacted characters can be recovered and used to effectively deredact first and last names. Unfortunately these findings affect redactions where the text underneath the black box is removed from the PDF. We demonstrate these findings by performing a comprehensive vulnerability assessment of common PDF redaction types. We examine 11 popular PDF redaction tools, including Adobe Acrobat, and find that they leak information about redacted text. We also effectively deredact hundreds of real-world PDF redactions, including those found in OIG investigation reports and FOIA responses. To correct the problem, we have released open source algorithms to fix vulnerable redactions and reduce the amount of information leaked by nonexcising redactions (where the text underneath the redaction is copy-pastable). We have also notified the developers of the studied redaction tools. We have notified the Office of Inspector General, the Free Law Project, PACER, Adobe, Microsoft, and the US Department of Justice. We are working with several of these groups to prevent our discoveries from being used for malicious purposes.

Proceedings of the 4th International Conference on Historical Cryptology HistoCrypt 2020

“…First, it seems that redaction is a weak way to protect secrets. Redaction techniques are, in general, susceptible to textual analysis or even to simple copy-paste removal of superimposed blanking (Bland et al, 2023;Ingram, 2019). Redactions applied to historical cryptological papers are vulnerable to techniques which would be recognised by codebreakers of the period from which they originate: contextual analysis allowing linguistic interpolation; parallel availability of the same text in a different communication; word length analysis; and fingerprinting.…”