Feeds

Adobe mulls changes to close hole in PDF apps

'Powerful functionality' v 'potential risks'

The Essential Guide to IT Transformation

Adobe Systems may make changes to its widely used PDF programs to prevent attackers from using them to mount attacks that hijack users' computers.

The attack was first demonstrated last week by researcher Didier Stevens. By misusing a feature contained in the PDF specification, his proof-of-concept attack showed how hackers could embed a malicious payload in a document and trick Adobe's Reader and Acrobat applications - as well as the competing FoxIT Reader - into executing it.

While Adobe applications warn users they are about to execute a potentially dangerous program, Stevens showed it was possible to modify the wording, increasing the attacker's chances of successfully socially engineering his victim.

Fellow security researcher Jeremy Conway soon adapted the technique to devise an attack that would allow a malicious payload stashed in one PDF file to spread to another document. A few days later a blogger who goes by the handle YunSoul, modified the attack further, showing how a single malicious PDF could infect an unlimited number of documents.

Steve Gottwals, a member of Adobe's security team, said it is in the process of reviewing the automatic launch feature in light of the new information.

"This is a good example of powerful functionality relied upon by some users that also carries potential risks when used incorrectly by others," he wrote. He went on to say: "We are currently researching the best approach for this functionality in Adobe Reader and Acrobat," and it may introduce changes in a future update.

In the meantime, users who have no need for the automatic launch feature (and we're guessing this is 90 percent or more of them) can mitigate the threat by modifying their Reader or Acrobat preferences. To do this, go to Edit > Preferences and click on Trust Manager in the left pane. Then, uncheck the box for "Allow opening of non-PDF file attachments with external applications."

System administrators managing large numbers of PCs can make the change en masse by modifying registry settings as further described here.

Conway told The Register that the mitigation neutralizes the recent attacks demonstrated by him and the other researchers. But it won't close the hole completely, he said. A separate PDF specification that allows applications to keep track of revisions could still be used to inject harmful code into PDFs using other types of programs.

"Anything that has write access can perform an incremental update," said Conway, who is a program manager for New Hampshire-based Nitrosecurity. "It stops the attack vector of using the launch command, but it doesn't fix the incremental update issue." ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.