Contract killer: Certified PDFs can be secretly tampered with during the signing process, boffins find
For documents where the annotations that are allowed to be added are more limited, Sneaky Signature comes into play. The second person to sign the document can do so, and then use that process to add additional information. That is to say, rather than abuse annotations, the signing process is exploited. "If a certified document is opened in a common PDF application, signatures can only be added to free signature fields provided by the certifier. Adding empty signature fields is normally no longer possible within the application," the paper states. "However, the specification does not prohibit...
Source: theregister.com