Feeds

Dear Adobe: It's time for security rehab

This is an intervention

Choosing a cloud hosting partner with confidence

Comment The stories about Adobe software keep coming, and the news hasn't been good. Critical bugs in Reader and Flash have come under real-world, zero-day attacks so many times in the past year that the exploits almost seem routine.

Security researchers such as Mike Bailey, Dan Kaminsky and Jeremiah Grossman and Robert "RSnake" Hansen have been exposing architectural flaws in Adobe Flash for years that compromise the safety of the entire internet, and yet many of them remain unfixed to this day. Even Apple boss Steve Jobs has turned sour on Adobe, proclaiming recently that when Macs crash "more often than not it's because of Flash."

The last straw came on Wednesday, when two researchers independently came up with separate attacks that pierce important memory protections Microsoft built to minimize the severity of security bugs contained in both home-grown and third-party applications that run on Windows. It was as if Adobe had sawed huge holes in a fairly effective safety net that Redmond went to considerable lengths to construct to keep its users safe.

It's against this backdrop that we propose that Adobe borrow a page from Toyota, another company facing a public relations crisis resulting from dangerous defects in its products. The steady stream of stories about broken acceleration pedals that cause drivers to lose control proved so damaging that the world's No. 1 car maker took the unprecedented step of taking eight top-selling models off the market until the hazard could be corrected. On Thursday, it went a step further, recalling 270,000 Priuses for unrelated brake problems.

Adobe needs to follow suit. Now.

Like Microsoft eight years ago, Adobe engineers should drop everything else and instead attend mandatory classes on secure development practices. Every line of code should be audited by an outside firm, and the programs should be rigorously subjected to fuzzers and other analysis tools. And while we're at it, Adobe should call a moratorium on all mergers and acquisitions, unless they add to its security muscle.

To be sure, this medicine wouldn't be easy for investors or employees to swallow, but it's for their own good. Besides, if the company can afford $1.8bln to expand into web analytics, it should be expected to spend equally princely sums to keep its considerable user base safe.

Last May's initiative by Adobe to beef up security of Reader and Acrobat was a step in the right direction, but details released to date suggest the effort is woefully inadequate. Mainly, that's because it focuses on only those two applications, rather than taking a more holistic approach, or at the very least including Flash.

Instead, like their counterparts at Toyota, Adobe executives need to admit they have a safety problem on their hands that's of epic proportions. It's time to suspend all elective development of Reader, Acrobat, and Flash for a set period of time - nine months to a year sounds right to us - and devote that time to identifying and repairing the considerable number of cracks in their foundations.

But most of all, it's time to stop the head-in-the-sand denials, like the one we got earlier this week from Adobe CTO Kevin Lynch, who protested a bit too loudly that his company would never "ship Flash with any known crash bugs." Rather breathtakingly, he insisted that "if there was such a widespread problem historically Flash could not have achieved its wide use today." As if the Ford Pinto, Chevy Corvair, or indeed the Toyota Camry didn't gain popular acceptance as well.

A comprehensive SDL, or secure development lifecycle, should also be undertaken, if Adobe wants to win back our trust.

Yes, it's asking a lot, but enough is enough. A suspension of business as usual seems to be the only way to correct what appears to be structural flaws that imperils us all. Just ask Toyota. ®

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.