Feeds

Adobe mulls changes to close hole in PDF apps

'Powerful functionality' v 'potential risks'

Choosing a cloud hosting partner with confidence

Adobe Systems may make changes to its widely used PDF programs to prevent attackers from using them to mount attacks that hijack users' computers.

The attack was first demonstrated last week by researcher Didier Stevens. By misusing a feature contained in the PDF specification, his proof-of-concept attack showed how hackers could embed a malicious payload in a document and trick Adobe's Reader and Acrobat applications - as well as the competing FoxIT Reader - into executing it.

While Adobe applications warn users they are about to execute a potentially dangerous program, Stevens showed it was possible to modify the wording, increasing the attacker's chances of successfully socially engineering his victim.

Fellow security researcher Jeremy Conway soon adapted the technique to devise an attack that would allow a malicious payload stashed in one PDF file to spread to another document. A few days later a blogger who goes by the handle YunSoul, modified the attack further, showing how a single malicious PDF could infect an unlimited number of documents.

Steve Gottwals, a member of Adobe's security team, said it is in the process of reviewing the automatic launch feature in light of the new information.

"This is a good example of powerful functionality relied upon by some users that also carries potential risks when used incorrectly by others," he wrote. He went on to say: "We are currently researching the best approach for this functionality in Adobe Reader and Acrobat," and it may introduce changes in a future update.

In the meantime, users who have no need for the automatic launch feature (and we're guessing this is 90 percent or more of them) can mitigate the threat by modifying their Reader or Acrobat preferences. To do this, go to Edit > Preferences and click on Trust Manager in the left pane. Then, uncheck the box for "Allow opening of non-PDF file attachments with external applications."

System administrators managing large numbers of PCs can make the change en masse by modifying registry settings as further described here.

Conway told The Register that the mitigation neutralizes the recent attacks demonstrated by him and the other researchers. But it won't close the hole completely, he said. A separate PDF specification that allows applications to keep track of revisions could still be used to inject harmful code into PDFs using other types of programs.

"Anything that has write access can perform an incremental update," said Conway, who is a program manager for New Hampshire-based Nitrosecurity. "It stops the attack vector of using the launch command, but it doesn't fix the incremental update issue." ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?