Feeds

What Adobe could learn from The Flying Wallendas

Do security safety nets make Reader less safe?

Beginner's guide to SSL certificates

Devs on a wire

“The whole idea of counting on certain sections of memory not being being executable and not being in the same place was pretty cool of Microsoft to add as a possibility,” said Gary McGraw, CTO of software security consultancy Cigital. “But it shows that just because that possibility exists on a platform doesn't mean that it's impossible to exploit. That's the key lesson here.”

As someone who regularly works with software companies, McGraw said he regularly encounters developers who view the mitigations as a license to be more careless than they otherwise would be.

“I know that people have kind of relied on DEP and ASLR to make up for not looking carefully enough for stack-based buffer overflows,” he explained. “They say, 'Well, it's alright because they're not going to be able to exploit it because of DEP or ASLR.' Guess what. That's not always true.”

It definitely wasn't true when going up against the authors of the Reader attack, who spared no effort in making sure their exploit compromised as many users as possible. In addition to ROP and heap-spraying techniques, they also embedded three different font libraries into their booby-trapped document to make sure it worked with versions that date back to October.

And lest would-be victims grew suspicious, the attackers signed their malware using a digital certificate belonging to Missouri-based Vantage Credit Union, a member-owned financial institution that encourages customers to “go bankless” by using their online service. According to this analysis by researchers from anti-virus firm Kaspersky, the malware bears the credit union's valid digital imprimatur, which “means that the cybercriminals must have got their hands on the private certificate.”

Vantage Director of Operations Dean Parkinson said the certificate was revoked shortly after his team learned it had been compromised. As a precaution, the server that administered the certificate has been temporarily shut down. The credit union is investigating how the private key was intercepted by the attackers.

Wallendas on bikes

The determination and sophistication of the attack, which is also well-documented by researchers from the Metasploit Project, means that mitigations such as DEP and ASLR are best viewed as hinderances that only make attackers' jobs harder. Think of them as a fireproof safe that's intended only to delay the amount of time before the contents are incinerated. Or a bullet-proof vest that provides no protection against a sharp shooter who hits his target in the head.

No doubt, Adobe should proceed with plans to implement a security sandbox that places a container around the application and sensitive parts of the operating system. A similar design seems to have served Google well by upping the ante against attacks that try to exploit its Chrome browser. And, as we've said before, Apple ought to design ASLR into its own Mac OS X.

But no security mitigation should be viewed as a substitute for cleaning up Reader's large, and considerably buggy, code base (or the code of any other widely used application, for that matter). At more than 41MB, it's more than five times as big as competing PDF reader Foxit, and that means there's five times the attack surface to exploit.

The risk of protections like DEP, ASLR and the upcoming sandbox is that Adobe developers will use them as a substitute for the onerous task of conducting line-by-line code audits. Or better yet, rewriting huge chunks of the application from scratch under a better-defined secure development lifecycle, in which security managers have veto power over their coding peers.

Of course, the Wallendas have had a few falls in their history. One came in 1962 while performing their crowd-wowing pyramid act, when two of the performers died. Another came in 1978, when Karl Wallenda fell to his death “because of several misconnected guy ropes along the wire,” according to the official Wallenda website.

But before that, there was a fall in Germany in the 1930s that claimed the life of Willie Wallenda while he was using a safety net at the insistence of his older brother Karl. The tragedy left a lasting impression on Karl that could also prove instructive to developers at Adobe and elsewhere.

“It emphasized that a net is not a foolproof safety device,” Tino said. “We train to do what we do and be successful at it. We train for success, not for failure.” ®

This article was updated to add comment from Vantage Credit Union. It was also updated to correct the definition of DEP.

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
SHELLSHOCKED: Fortune 1000 outfits Bash out batches of patches
CloudPassage points to 'pervasive' threat of Bash bug
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.