Feeds

Dear Adobe: It's time for security rehab

This is an intervention

Providing a secure and efficient Helpdesk

Comment The stories about Adobe software keep coming, and the news hasn't been good. Critical bugs in Reader and Flash have come under real-world, zero-day attacks so many times in the past year that the exploits almost seem routine.

Security researchers such as Mike Bailey, Dan Kaminsky and Jeremiah Grossman and Robert "RSnake" Hansen have been exposing architectural flaws in Adobe Flash for years that compromise the safety of the entire internet, and yet many of them remain unfixed to this day. Even Apple boss Steve Jobs has turned sour on Adobe, proclaiming recently that when Macs crash "more often than not it's because of Flash."

The last straw came on Wednesday, when two researchers independently came up with separate attacks that pierce important memory protections Microsoft built to minimize the severity of security bugs contained in both home-grown and third-party applications that run on Windows. It was as if Adobe had sawed huge holes in a fairly effective safety net that Redmond went to considerable lengths to construct to keep its users safe.

It's against this backdrop that we propose that Adobe borrow a page from Toyota, another company facing a public relations crisis resulting from dangerous defects in its products. The steady stream of stories about broken acceleration pedals that cause drivers to lose control proved so damaging that the world's No. 1 car maker took the unprecedented step of taking eight top-selling models off the market until the hazard could be corrected. On Thursday, it went a step further, recalling 270,000 Priuses for unrelated brake problems.

Adobe needs to follow suit. Now.

Like Microsoft eight years ago, Adobe engineers should drop everything else and instead attend mandatory classes on secure development practices. Every line of code should be audited by an outside firm, and the programs should be rigorously subjected to fuzzers and other analysis tools. And while we're at it, Adobe should call a moratorium on all mergers and acquisitions, unless they add to its security muscle.

To be sure, this medicine wouldn't be easy for investors or employees to swallow, but it's for their own good. Besides, if the company can afford $1.8bln to expand into web analytics, it should be expected to spend equally princely sums to keep its considerable user base safe.

Last May's initiative by Adobe to beef up security of Reader and Acrobat was a step in the right direction, but details released to date suggest the effort is woefully inadequate. Mainly, that's because it focuses on only those two applications, rather than taking a more holistic approach, or at the very least including Flash.

Instead, like their counterparts at Toyota, Adobe executives need to admit they have a safety problem on their hands that's of epic proportions. It's time to suspend all elective development of Reader, Acrobat, and Flash for a set period of time - nine months to a year sounds right to us - and devote that time to identifying and repairing the considerable number of cracks in their foundations.

But most of all, it's time to stop the head-in-the-sand denials, like the one we got earlier this week from Adobe CTO Kevin Lynch, who protested a bit too loudly that his company would never "ship Flash with any known crash bugs." Rather breathtakingly, he insisted that "if there was such a widespread problem historically Flash could not have achieved its wide use today." As if the Ford Pinto, Chevy Corvair, or indeed the Toyota Camry didn't gain popular acceptance as well.

A comprehensive SDL, or secure development lifecycle, should also be undertaken, if Adobe wants to win back our trust.

Yes, it's asking a lot, but enough is enough. A suspension of business as usual seems to be the only way to correct what appears to be structural flaws that imperils us all. Just ask Toyota. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.