Feeds

Adobe mulls changes to close hole in PDF apps

'Powerful functionality' v 'potential risks'

Combat fraud and increase customer satisfaction

Adobe Systems may make changes to its widely used PDF programs to prevent attackers from using them to mount attacks that hijack users' computers.

The attack was first demonstrated last week by researcher Didier Stevens. By misusing a feature contained in the PDF specification, his proof-of-concept attack showed how hackers could embed a malicious payload in a document and trick Adobe's Reader and Acrobat applications - as well as the competing FoxIT Reader - into executing it.

While Adobe applications warn users they are about to execute a potentially dangerous program, Stevens showed it was possible to modify the wording, increasing the attacker's chances of successfully socially engineering his victim.

Fellow security researcher Jeremy Conway soon adapted the technique to devise an attack that would allow a malicious payload stashed in one PDF file to spread to another document. A few days later a blogger who goes by the handle YunSoul, modified the attack further, showing how a single malicious PDF could infect an unlimited number of documents.

Steve Gottwals, a member of Adobe's security team, said it is in the process of reviewing the automatic launch feature in light of the new information.

"This is a good example of powerful functionality relied upon by some users that also carries potential risks when used incorrectly by others," he wrote. He went on to say: "We are currently researching the best approach for this functionality in Adobe Reader and Acrobat," and it may introduce changes in a future update.

In the meantime, users who have no need for the automatic launch feature (and we're guessing this is 90 percent or more of them) can mitigate the threat by modifying their Reader or Acrobat preferences. To do this, go to Edit > Preferences and click on Trust Manager in the left pane. Then, uncheck the box for "Allow opening of non-PDF file attachments with external applications."

System administrators managing large numbers of PCs can make the change en masse by modifying registry settings as further described here.

Conway told The Register that the mitigation neutralizes the recent attacks demonstrated by him and the other researchers. But it won't close the hole completely, he said. A separate PDF specification that allows applications to keep track of revisions could still be used to inject harmful code into PDFs using other types of programs.

"Anything that has write access can perform an incremental update," said Conway, who is a program manager for New Hampshire-based Nitrosecurity. "It stops the attack vector of using the launch command, but it doesn't fix the incremental update issue." ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.