Feeds

What Adobe could learn from The Flying Wallendas

Do security safety nets make Reader less safe?

The essential guide to IT transformation

Devs on a wire

“The whole idea of counting on certain sections of memory not being being executable and not being in the same place was pretty cool of Microsoft to add as a possibility,” said Gary McGraw, CTO of software security consultancy Cigital. “But it shows that just because that possibility exists on a platform doesn't mean that it's impossible to exploit. That's the key lesson here.”

As someone who regularly works with software companies, McGraw said he regularly encounters developers who view the mitigations as a license to be more careless than they otherwise would be.

“I know that people have kind of relied on DEP and ASLR to make up for not looking carefully enough for stack-based buffer overflows,” he explained. “They say, 'Well, it's alright because they're not going to be able to exploit it because of DEP or ASLR.' Guess what. That's not always true.”

It definitely wasn't true when going up against the authors of the Reader attack, who spared no effort in making sure their exploit compromised as many users as possible. In addition to ROP and heap-spraying techniques, they also embedded three different font libraries into their booby-trapped document to make sure it worked with versions that date back to October.

And lest would-be victims grew suspicious, the attackers signed their malware using a digital certificate belonging to Missouri-based Vantage Credit Union, a member-owned financial institution that encourages customers to “go bankless” by using their online service. According to this analysis by researchers from anti-virus firm Kaspersky, the malware bears the credit union's valid digital imprimatur, which “means that the cybercriminals must have got their hands on the private certificate.”

Vantage Director of Operations Dean Parkinson said the certificate was revoked shortly after his team learned it had been compromised. As a precaution, the server that administered the certificate has been temporarily shut down. The credit union is investigating how the private key was intercepted by the attackers.

Wallendas on bikes

The determination and sophistication of the attack, which is also well-documented by researchers from the Metasploit Project, means that mitigations such as DEP and ASLR are best viewed as hinderances that only make attackers' jobs harder. Think of them as a fireproof safe that's intended only to delay the amount of time before the contents are incinerated. Or a bullet-proof vest that provides no protection against a sharp shooter who hits his target in the head.

No doubt, Adobe should proceed with plans to implement a security sandbox that places a container around the application and sensitive parts of the operating system. A similar design seems to have served Google well by upping the ante against attacks that try to exploit its Chrome browser. And, as we've said before, Apple ought to design ASLR into its own Mac OS X.

But no security mitigation should be viewed as a substitute for cleaning up Reader's large, and considerably buggy, code base (or the code of any other widely used application, for that matter). At more than 41MB, it's more than five times as big as competing PDF reader Foxit, and that means there's five times the attack surface to exploit.

The risk of protections like DEP, ASLR and the upcoming sandbox is that Adobe developers will use them as a substitute for the onerous task of conducting line-by-line code audits. Or better yet, rewriting huge chunks of the application from scratch under a better-defined secure development lifecycle, in which security managers have veto power over their coding peers.

Of course, the Wallendas have had a few falls in their history. One came in 1962 while performing their crowd-wowing pyramid act, when two of the performers died. Another came in 1978, when Karl Wallenda fell to his death “because of several misconnected guy ropes along the wire,” according to the official Wallenda website.

But before that, there was a fall in Germany in the 1930s that claimed the life of Willie Wallenda while he was using a safety net at the insistence of his older brother Karl. The tragedy left a lasting impression on Karl that could also prove instructive to developers at Adobe and elsewhere.

“It emphasized that a net is not a foolproof safety device,” Tino said. “We train to do what we do and be successful at it. We train for success, not for failure.” ®

This article was updated to add comment from Vantage Credit Union. It was also updated to correct the definition of DEP.

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.