Feeds

What Adobe could learn from The Flying Wallendas

Do security safety nets make Reader less safe?

Beginner's guide to SSL certificates

Devs on a wire

“The whole idea of counting on certain sections of memory not being being executable and not being in the same place was pretty cool of Microsoft to add as a possibility,” said Gary McGraw, CTO of software security consultancy Cigital. “But it shows that just because that possibility exists on a platform doesn't mean that it's impossible to exploit. That's the key lesson here.”

As someone who regularly works with software companies, McGraw said he regularly encounters developers who view the mitigations as a license to be more careless than they otherwise would be.

“I know that people have kind of relied on DEP and ASLR to make up for not looking carefully enough for stack-based buffer overflows,” he explained. “They say, 'Well, it's alright because they're not going to be able to exploit it because of DEP or ASLR.' Guess what. That's not always true.”

It definitely wasn't true when going up against the authors of the Reader attack, who spared no effort in making sure their exploit compromised as many users as possible. In addition to ROP and heap-spraying techniques, they also embedded three different font libraries into their booby-trapped document to make sure it worked with versions that date back to October.

And lest would-be victims grew suspicious, the attackers signed their malware using a digital certificate belonging to Missouri-based Vantage Credit Union, a member-owned financial institution that encourages customers to “go bankless” by using their online service. According to this analysis by researchers from anti-virus firm Kaspersky, the malware bears the credit union's valid digital imprimatur, which “means that the cybercriminals must have got their hands on the private certificate.”

Vantage Director of Operations Dean Parkinson said the certificate was revoked shortly after his team learned it had been compromised. As a precaution, the server that administered the certificate has been temporarily shut down. The credit union is investigating how the private key was intercepted by the attackers.

Wallendas on bikes

The determination and sophistication of the attack, which is also well-documented by researchers from the Metasploit Project, means that mitigations such as DEP and ASLR are best viewed as hinderances that only make attackers' jobs harder. Think of them as a fireproof safe that's intended only to delay the amount of time before the contents are incinerated. Or a bullet-proof vest that provides no protection against a sharp shooter who hits his target in the head.

No doubt, Adobe should proceed with plans to implement a security sandbox that places a container around the application and sensitive parts of the operating system. A similar design seems to have served Google well by upping the ante against attacks that try to exploit its Chrome browser. And, as we've said before, Apple ought to design ASLR into its own Mac OS X.

But no security mitigation should be viewed as a substitute for cleaning up Reader's large, and considerably buggy, code base (or the code of any other widely used application, for that matter). At more than 41MB, it's more than five times as big as competing PDF reader Foxit, and that means there's five times the attack surface to exploit.

The risk of protections like DEP, ASLR and the upcoming sandbox is that Adobe developers will use them as a substitute for the onerous task of conducting line-by-line code audits. Or better yet, rewriting huge chunks of the application from scratch under a better-defined secure development lifecycle, in which security managers have veto power over their coding peers.

Of course, the Wallendas have had a few falls in their history. One came in 1962 while performing their crowd-wowing pyramid act, when two of the performers died. Another came in 1978, when Karl Wallenda fell to his death “because of several misconnected guy ropes along the wire,” according to the official Wallenda website.

But before that, there was a fall in Germany in the 1930s that claimed the life of Willie Wallenda while he was using a safety net at the insistence of his older brother Karl. The tragedy left a lasting impression on Karl that could also prove instructive to developers at Adobe and elsewhere.

“It emphasized that a net is not a foolproof safety device,” Tino said. “We train to do what we do and be successful at it. We train for success, not for failure.” ®

This article was updated to add comment from Vantage Credit Union. It was also updated to correct the definition of DEP.

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.