marshalgraham

Removing PDF Metadata with PDF Toolkit

2011-04-24T20:39:00.000-07:00

I little while back, I wrote Fear the FOCA! This is a short write up on retrieving and analyzing metadata using FOCA Free. If you do not know what metadata is, you can think of it as data that describes data. Metadata can be simple information like the document title and the creation and modification dates of the file. It can also contain more sensitive information including names, usernames, computer names, software versions, operating systems, and email addresses. While this may seem harmless, in the hands of a social engineer this information can be very valuable.

One of the problems with metadata is that many people are not aware that metadata even exists or could pose a threat. Because of this, metadata often leaks onto public web servers despite being easy to remove.

One tool that you can use to manipulate metadata in PDF files is the PDF Toolkit or pdftk. Pdftk is a command line tool making it a great choice for scripting. It is available for Linux, Windows, and Mac. This article will demonstrate how to use pdftk on Linux to remove metadata from PDF files. I am using Ubuntu Linux for this article but I have also used pdftk on CentOS. These directions should work on Windows or Mac but I have not tested those platforms.

I have divided this article in to three sections:
Installing The PDF Toolkit
Getting Started With pdftk
Scripting pdftk

Installing The PDF Toolkit

To get started, you will need to install PDF Toolkit (referred to as pdftk). On Ubuntu, simply go to a command prompt and enter

sudo apt-get install pdftk

APT will take care of the dependencies and install pdftk. As of this writing, the Ubuntu package is a little outdated (1.41) but still works for my purposes. If you would like the newest version, you can get it from the PDF Toolkit website at http://www.pdflabs.com/docs/install-pdftk/.

Once you have pdftk installed, you will need a PDF document to analyze. If you do not have a PDF file available, a quick Google search using the "filetype:pdf" keyword should help you get started. My file is named sample.pdf. You will need to substitute your file name in the examples.

Getting Started with pdftk

The first step is to see what metadata is in your file. The command to do this is:

pdftk sample.pdf dump_data

When you enter this command, you will get output similiar to the screen shot below.

While this is useful to view the data, we need to do more. We will put the metadata into a file so it can be manipulated. Use the same command with a little modification.

pdftk sample.pdf dump_data output pdf-metadata

This command will not create any output. It will create a file, pdf-metadata, that contains a copy of the metadata from sample.pdf. You will need to open the pdf-metadata file with the editor of your choice and remove the values from InfoValue. Also remove any other references like bookmarks, page labels, or ids. The pdf-metadata file should look like the screen shot below.

Save the pdf-metadata file. Now we are ready to use that data to wipe the metadata from our sample file. The command to do this is:

pdftk sample.pdf update_info pdf-metadata output sample-no-metadata.pdf

This command will also not produce any output. It takes the original sample.pdf file and create a copy named sample-no-metadata.pdf. The (lack of) metadata from pdf-metadata is used to overwrite the existing metadata. You can test this by using the command from earlier.

pdftk sample-no-metadata.pdf dump_data

You should see much less metadata now. Pdftk adds the Producer and ModDate metadata but all of the other metadata is now gone!

Keep reading for tips on using pdftk in scripts for bulk metadata manipulation.

Scripting pdftk

The above directions are useful but there are much simpler ways to remove metadata from a single PDF document. The value of pdftk is in scripting. Below is my simple script to remove metadata from PDF documents in the /var/www/html directory structure.

#!/bin/bash
SAVEIFS=$IFS
IFS=$(echo -en "\n\b")

pdftk_path="/usr/local/bin/pdftk" # full path to pdftk binary
pdf_infokeys="~/pdf-infokeys"      # full path to file containing new metadata
pdf_search_path="/var/www/html"    # path to search for pdf files
pdf_temp_path="/tmp"               # temporary directory

for i in $( find $pdf_search_path -type f -name "*.pdf" ); do
cp $i $pdf_temp_path/temp.pdf
$pdftk_path $pdf_temp_path/temp.pdf update_info $pdf_infokeys output $i
rm $pdf_temp_path/temp.pdf
done

IFS=$SAVEIFS

You need to modify the four lines that begin with pdf_ to match your environment. If you are familiar with Bash scripting, then you should not have trouble following this script. However, there is one part that requires further explanation. You need to create the pdf-infokeys file. This is a list of all of the InfoKey data that is found in your PDF files.

Here is a simple way to get that data. Start by opening a terminal window and running this command (modified to search your directory structure):

find /var/www/html -type f -name "*.pdf" -exec ./pdftk {} dump_data \; | \
grep -i infokey | \
sort -u > ~/pdf-infokeys

If you have password protected PDF documents, this may produce a few errors. These can be safely ignored. You will end up with a pdf-infokeys file that contains something similiar to this:

InfoKey: Author
InfoKey: Company
InfoKey: CreationDate
InfoKey: Creator
InfoKey: ModDate
InfoKey: Producer
InfoKey: SourceModified
InfoKey: Title

Open pdf-infokeys with your favorite editor (like vi) and modify it so it looks similiar to this:

InfoKey: Author
InfoValue:
InfoKey: Company
InfoValue:
InfoKey: CreationDate
InfoValue:
InfoKey: Creator
InfoValue:
InfoKey: ModDate
InfoValue:
InfoKey: Producer
InfoValue:
InfoKey: SourceModified
InfoValue:
InfoKey: Title
InfoValue:

Now, save the file and you can use the script above.

Hopefully you found this useful. Please feel free to leave comments or questions below. Thanks for visiting.

Note: For an explanation of the $IFS variable from the script above, check out http://www.cyberciti.biz/tips/handling-filenames-with-spaces-in-bash.html. This is a work around for dealing with spaces found in the path or file name used in bash script loops.

Install Android Market On Nook Honeycomb Tablet

2011-04-14T20:42:00.000-07:00

In the last post, I walked through getting Deeper Blue's Honeycomb preview image running on the Barnes and Noble Nook Color. I've been using the Nook as a Honeycomb tablet for a couple of weeks and overall it works very well. There are a couple of bugs but that is to be expected from a preview image. There was one particular thing that bothered me though, there is no Android Market. If you look through the FAQ on this forum.xda-developers.com thread, you will understand why Deeper Blue did not include the Market in the image.

Q: Why is there no Market app installed?
A: There's no legal way to distribute the google apps with a ROM.

While they are not included in the image, there is a way to get the Android Market, GMail, and Maps apps on your Nook Honeycomb tablet. Here's what you will need:

Nook Honeycomb Tablet from my previous post
Nook Color USB cable
Android Central Sideload Wonder Machine
HoneyGApps.v2.zip from jleecong at xda-developers
Windows XP/Vista/7 computer

While you don't actually need the Android Central Sideload Wonder Machine (AC_SWM), it is probably the simplest way to get the adb.exe file you will need. Adb.exe is used to push the Android Market app to your Nook. Plus, AC_SWM is a handy application if you own any Android devices. If you already have adb.exe from the Android SDK or another application, you can use that adb.exe instead of AC_SWM.

Start off by going to http://nookdevs.com/NookColor_USB_ADB#Windows_XP.2C_Vista_and_7 and following the directions to get the Nook Color driver working in Windows. The good folks at nookdevs.com have done a great job of explaining the driver installation so I'm not going to repeat the information here. You will not need the full Android SDK so just do steps 2 (II) and 3 (III); "II. Patch the USB Driver files" and "III. Connect the device and install the drivers." Come back here after you have the driver installed.

After the driver is installed, extract AC_SWM to the root of your C: drive. It needs to be in a folder named C:\AC_SWM like the image below.

Next, extract the contents of HoneyGApps.v2.zip in to the C:\AC_SWM folder. You need to end up with adb.exe and all of the .apk files from HoneyGApps.v2.zip in the same folder (C:\AC_SWM), see below.

Turn on your Nook Honeycomb tablet. Choose Apps->Settings->Applications->Development and make sure that USB debugging is enabled. Now, connect the USB cable to the Nook and your computer.

Navigate back to C:\AC_SWM and double click on HoneyGAppInstall.cmd.

Hopefully, you see output like the image above and it runs without errors. If everything goes smoothly, your Nook will reboot. After Honeycomb starts back up, choose Apps and look for the new Market, Gmail, and Maps icons. Enjoy!

If you found this information was helpful for you or if you ran into trouble, please leave a comment below. Thanks for visiting!

All of the credit for the Nook Honeycomb image, Nook driver, and Google Apps work should go to the development communities at xda-developers and nookdevs.com.

Turn Your Nook Color Into A Honeycomb Android Tablet

2011-04-11T20:09:00.000-07:00

The Barnes and Noble Nook Color is a great device for hackers. You can root the Nook software and run Android Market and your own apps. You can also turn your Nook Color into a Honeycomb Android tablet.

One of the neat features of the Nook Color is its ability to boot from a micro SD card. This feature is what allows you to root the device and it is also what allows you to run another operating system and still retain the full Nook capabilities. The directions below are a non-destructive method for running Honeycomb on a Nook Color.

Standard Disclaimer: If you follow the directions below, you are doing something that the Nook Color developers never intended. I have made every effort to ensure this article is accurate but there is a risk you could foul up your SD card, your computer, and/or your Nook Color. While I am currently running Honeycomb on a Nook Color, that does not mean it will work for everyone. Please consider the previous statements before proceeding on in this article.

Here is what you need:

Barnes and Noble Nook Color
Micro SD card (at least 4 GB) and adapter (see note2 below)
SD card reader (either USB or built-in)
Image Writer for Windows
Nook Honeycomb image file from xda-developers

Insert your Micro SD card into the adapter and then insert that into your SD card reader. Determine which drive letter your SD card reader is using. This is very important! If you choose the wrong drive letter, you will completely overwrite the contents of that drive. When you are certain you have the correct drive letter, continue below.

Extract Image Writer for Windows and the nookhoney04.img file. Start Win32DiskImager.exe. On Windows Vista/7, you will need to start this with Administrator priveleges.

Click on the small blue folder icon and locate your nookhoney04.img file. Make sure you have the correct drive letter for your SD card reader and then click Write. It will probably take a few minutes to write the image file to the card. When it is done, click Exit and remove your Micro SD card.

Find the Micro SD card slot on your Nook. It's hidden on the back side on the corner that is "broken." There is a small flap that you need to lift to reveal the slot. The slot is spring loaded so you will need to insert your Micro SD card and press it in until you hear a click. If you have large hands, it may be difficult to get the card inserted.

After the card is inserted, power up your Nook Color and it will boot Honeycomb! You will notice a few things missing, primarily there is no GMail or Android Market. Here's the explanation from the Nook Honeycomb image creator on forum.xda-developers.com:
Q: Why is there no Market app installed?
A: There's no legal way to distribute the google apps with a ROM.

So, there you have it. Not to worry though, in the next post I will walk you through installing the Android Market and GMail on your new Nook Honeycomb Tablet.

Note: If you decide you want to run the Nook software again, simply power the Nook down and remove the Micro SD card. Turn the Nook back on and you are running the Nook software again.

Note2: The class of your SD card will affect the performance of Honeycomb on the Nook Color. I first used a class 2 card and had noticeable lag in the UI. I am now using a class 6 card and have no performance problems. If you are considering purchasing an SD card, I would suggest doing a little research at the Nook Color forums on xda-developers.com or nookdevs.com.

Update 4/12/2011: Fixed typos and added disclaimer.
Update 4/14/2011: Added link to article on installing Android Market.

Move Minimize, Maximize, and Close Buttons to the Right Side in Ubuntu 10.04 and 10.10

2011-04-07T19:21:00.000-07:00

This has to be one of the most annoying things I have found in a while. In Ubuntu 10.04 and 10.10, the window control buttons have been moved from the upper right corner where they would normally be found, to the upper left hand corner. If you are like me, you find this annoying. Fortunately, this is easy to fix.

Start a terminal and enter the command gconf-editor. On the left, choose apps, metacity, and general.

Find the entry for button_layout and change it from "close,minimize,maximize:" to "menu:minimize,maximize,close" without the quotes.

The change takes effect immediately so simply close the window, from the upper right corner.