Feeds

Dear Adobe: It's time for security rehab

This is an intervention

Protecting users from Firesheep and other Sidejacking attacks with SSL

Comment The stories about Adobe software keep coming, and the news hasn't been good. Critical bugs in Reader and Flash have come under real-world, zero-day attacks so many times in the past year that the exploits almost seem routine.

Security researchers such as Mike Bailey, Dan Kaminsky and Jeremiah Grossman and Robert "RSnake" Hansen have been exposing architectural flaws in Adobe Flash for years that compromise the safety of the entire internet, and yet many of them remain unfixed to this day. Even Apple boss Steve Jobs has turned sour on Adobe, proclaiming recently that when Macs crash "more often than not it's because of Flash."

The last straw came on Wednesday, when two researchers independently came up with separate attacks that pierce important memory protections Microsoft built to minimize the severity of security bugs contained in both home-grown and third-party applications that run on Windows. It was as if Adobe had sawed huge holes in a fairly effective safety net that Redmond went to considerable lengths to construct to keep its users safe.

It's against this backdrop that we propose that Adobe borrow a page from Toyota, another company facing a public relations crisis resulting from dangerous defects in its products. The steady stream of stories about broken acceleration pedals that cause drivers to lose control proved so damaging that the world's No. 1 car maker took the unprecedented step of taking eight top-selling models off the market until the hazard could be corrected. On Thursday, it went a step further, recalling 270,000 Priuses for unrelated brake problems.

Adobe needs to follow suit. Now.

Like Microsoft eight years ago, Adobe engineers should drop everything else and instead attend mandatory classes on secure development practices. Every line of code should be audited by an outside firm, and the programs should be rigorously subjected to fuzzers and other analysis tools. And while we're at it, Adobe should call a moratorium on all mergers and acquisitions, unless they add to its security muscle.

To be sure, this medicine wouldn't be easy for investors or employees to swallow, but it's for their own good. Besides, if the company can afford $1.8bln to expand into web analytics, it should be expected to spend equally princely sums to keep its considerable user base safe.

Last May's initiative by Adobe to beef up security of Reader and Acrobat was a step in the right direction, but details released to date suggest the effort is woefully inadequate. Mainly, that's because it focuses on only those two applications, rather than taking a more holistic approach, or at the very least including Flash.

Instead, like their counterparts at Toyota, Adobe executives need to admit they have a safety problem on their hands that's of epic proportions. It's time to suspend all elective development of Reader, Acrobat, and Flash for a set period of time - nine months to a year sounds right to us - and devote that time to identifying and repairing the considerable number of cracks in their foundations.

But most of all, it's time to stop the head-in-the-sand denials, like the one we got earlier this week from Adobe CTO Kevin Lynch, who protested a bit too loudly that his company would never "ship Flash with any known crash bugs." Rather breathtakingly, he insisted that "if there was such a widespread problem historically Flash could not have achieved its wide use today." As if the Ford Pinto, Chevy Corvair, or indeed the Toyota Camry didn't gain popular acceptance as well.

A comprehensive SDL, or secure development lifecycle, should also be undertaken, if Adobe wants to win back our trust.

Yes, it's asking a lot, but enough is enough. A suspension of business as usual seems to be the only way to correct what appears to be structural flaws that imperils us all. Just ask Toyota. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.