Feeds

What Adobe could learn from The Flying Wallendas

Do security safety nets make Reader less safe?

5 things you didn’t know about cloud backup

Devs on a wire

“The whole idea of counting on certain sections of memory not being being executable and not being in the same place was pretty cool of Microsoft to add as a possibility,” said Gary McGraw, CTO of software security consultancy Cigital. “But it shows that just because that possibility exists on a platform doesn't mean that it's impossible to exploit. That's the key lesson here.”

As someone who regularly works with software companies, McGraw said he regularly encounters developers who view the mitigations as a license to be more careless than they otherwise would be.

“I know that people have kind of relied on DEP and ASLR to make up for not looking carefully enough for stack-based buffer overflows,” he explained. “They say, 'Well, it's alright because they're not going to be able to exploit it because of DEP or ASLR.' Guess what. That's not always true.”

It definitely wasn't true when going up against the authors of the Reader attack, who spared no effort in making sure their exploit compromised as many users as possible. In addition to ROP and heap-spraying techniques, they also embedded three different font libraries into their booby-trapped document to make sure it worked with versions that date back to October.

And lest would-be victims grew suspicious, the attackers signed their malware using a digital certificate belonging to Missouri-based Vantage Credit Union, a member-owned financial institution that encourages customers to “go bankless” by using their online service. According to this analysis by researchers from anti-virus firm Kaspersky, the malware bears the credit union's valid digital imprimatur, which “means that the cybercriminals must have got their hands on the private certificate.”

Vantage Director of Operations Dean Parkinson said the certificate was revoked shortly after his team learned it had been compromised. As a precaution, the server that administered the certificate has been temporarily shut down. The credit union is investigating how the private key was intercepted by the attackers.

Wallendas on bikes

The determination and sophistication of the attack, which is also well-documented by researchers from the Metasploit Project, means that mitigations such as DEP and ASLR are best viewed as hinderances that only make attackers' jobs harder. Think of them as a fireproof safe that's intended only to delay the amount of time before the contents are incinerated. Or a bullet-proof vest that provides no protection against a sharp shooter who hits his target in the head.

No doubt, Adobe should proceed with plans to implement a security sandbox that places a container around the application and sensitive parts of the operating system. A similar design seems to have served Google well by upping the ante against attacks that try to exploit its Chrome browser. And, as we've said before, Apple ought to design ASLR into its own Mac OS X.

But no security mitigation should be viewed as a substitute for cleaning up Reader's large, and considerably buggy, code base (or the code of any other widely used application, for that matter). At more than 41MB, it's more than five times as big as competing PDF reader Foxit, and that means there's five times the attack surface to exploit.

The risk of protections like DEP, ASLR and the upcoming sandbox is that Adobe developers will use them as a substitute for the onerous task of conducting line-by-line code audits. Or better yet, rewriting huge chunks of the application from scratch under a better-defined secure development lifecycle, in which security managers have veto power over their coding peers.

Of course, the Wallendas have had a few falls in their history. One came in 1962 while performing their crowd-wowing pyramid act, when two of the performers died. Another came in 1978, when Karl Wallenda fell to his death “because of several misconnected guy ropes along the wire,” according to the official Wallenda website.

But before that, there was a fall in Germany in the 1930s that claimed the life of Willie Wallenda while he was using a safety net at the insistence of his older brother Karl. The tragedy left a lasting impression on Karl that could also prove instructive to developers at Adobe and elsewhere.

“It emphasized that a net is not a foolproof safety device,” Tino said. “We train to do what we do and be successful at it. We train for success, not for failure.” ®

This article was updated to add comment from Vantage Credit Union. It was also updated to correct the definition of DEP.

The essential guide to IT transformation

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?