Feeds

Dear Adobe: It's time for security rehab

This is an intervention

Using blade systems to cut costs and sharpen efficiencies

Comment The stories about Adobe software keep coming, and the news hasn't been good. Critical bugs in Reader and Flash have come under real-world, zero-day attacks so many times in the past year that the exploits almost seem routine.

Security researchers such as Mike Bailey, Dan Kaminsky and Jeremiah Grossman and Robert "RSnake" Hansen have been exposing architectural flaws in Adobe Flash for years that compromise the safety of the entire internet, and yet many of them remain unfixed to this day. Even Apple boss Steve Jobs has turned sour on Adobe, proclaiming recently that when Macs crash "more often than not it's because of Flash."

The last straw came on Wednesday, when two researchers independently came up with separate attacks that pierce important memory protections Microsoft built to minimize the severity of security bugs contained in both home-grown and third-party applications that run on Windows. It was as if Adobe had sawed huge holes in a fairly effective safety net that Redmond went to considerable lengths to construct to keep its users safe.

It's against this backdrop that we propose that Adobe borrow a page from Toyota, another company facing a public relations crisis resulting from dangerous defects in its products. The steady stream of stories about broken acceleration pedals that cause drivers to lose control proved so damaging that the world's No. 1 car maker took the unprecedented step of taking eight top-selling models off the market until the hazard could be corrected. On Thursday, it went a step further, recalling 270,000 Priuses for unrelated brake problems.

Adobe needs to follow suit. Now.

Like Microsoft eight years ago, Adobe engineers should drop everything else and instead attend mandatory classes on secure development practices. Every line of code should be audited by an outside firm, and the programs should be rigorously subjected to fuzzers and other analysis tools. And while we're at it, Adobe should call a moratorium on all mergers and acquisitions, unless they add to its security muscle.

To be sure, this medicine wouldn't be easy for investors or employees to swallow, but it's for their own good. Besides, if the company can afford $1.8bln to expand into web analytics, it should be expected to spend equally princely sums to keep its considerable user base safe.

Last May's initiative by Adobe to beef up security of Reader and Acrobat was a step in the right direction, but details released to date suggest the effort is woefully inadequate. Mainly, that's because it focuses on only those two applications, rather than taking a more holistic approach, or at the very least including Flash.

Instead, like their counterparts at Toyota, Adobe executives need to admit they have a safety problem on their hands that's of epic proportions. It's time to suspend all elective development of Reader, Acrobat, and Flash for a set period of time - nine months to a year sounds right to us - and devote that time to identifying and repairing the considerable number of cracks in their foundations.

But most of all, it's time to stop the head-in-the-sand denials, like the one we got earlier this week from Adobe CTO Kevin Lynch, who protested a bit too loudly that his company would never "ship Flash with any known crash bugs." Rather breathtakingly, he insisted that "if there was such a widespread problem historically Flash could not have achieved its wide use today." As if the Ford Pinto, Chevy Corvair, or indeed the Toyota Camry didn't gain popular acceptance as well.

A comprehensive SDL, or secure development lifecycle, should also be undertaken, if Adobe wants to win back our trust.

Yes, it's asking a lot, but enough is enough. A suspension of business as usual seems to be the only way to correct what appears to be structural flaws that imperils us all. Just ask Toyota. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.