你能接受陌生人的LaTeX文件吗？十年后
Can You Accept LaTeX Files from Strangers? Ten Years Later
摘要：
众所周知，Microsoft Word/Excel兼容文档或PDF文件可能包含恶意内容。LaTeX文件也不例外。LaTeX用户通常通过源代码或软件包（. sty或. cls文件）包含第三方代码。但这些软件包可以在用户系统上执行恶意命令，以捕获敏感信息或执行拒绝服务攻击。Checkoway等人是第一个警告LaTeX用户这些威胁的人。基于云的协作LaTeX编辑器和编译LaTeX源的服务尤其受到关注。在本文中，我们创建了一个LaTeX包，它收集系统数据并将其隐藏在目标生成的PDF文件中。然后，我们测量了黑客使用在线服务上的恶意LaTeX文件可以恢复什么，以及这些服务强制执行哪些措施来阻止威胁。服务使用沙箱或命令限制来保护自己。命令限制更难设置，我们发现一个服务（PMLatex）过于宽松。
英文摘要：
It is well-known that Microsoft Word/Excel compatible documents or PDF files can contain malicious content. LaTeX files are unfortunately no exception either. LaTeX users often include third-party codes through sources or packages (.sty or .cls files). But those packages can execute malicious commands on the users' system, in order to capture sensitive information or to perform denial of service attacks. Checkoway et al. [3] were the first to warn LaTeX users of these threats. Collaborative cloud-based LaTeX editors and services compiling LaTeX sources are particularly concerned. In this paper, we have created a LaTeX package that collects system data and hides them inside the PDF file produced by the target. Then, we have measured what can be recovered by hackers using malicious LaTeX file on online services, and which measures those services have enforced to thwart the threats. Services defend themselves using sandbox or commands restrictions. Commands restrictions are more difficult to setup and we found one service (PMLatex) which is too permissive.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
