Feeds

Adobe preps sandboxing tech to fight exploits

Play safe

Protecting against web application threats using SSL

Adobe has fleshed out its plans to offer sandboxing as a mechanism to limit the impact of attacks against its ubiquitous Adobe Reader PDF reader application.

Available from November, Adobe Reader X will incorporate virtual sandboxing technology that will place controls on the application's ability to modify the registry or execute unwanted content.

Adobe Reader X Protected Mode is listed as one of six key improvements due in Adobe PDF application suite. Other enhancements include the ability for users to "view and interact with PDF files that contain an even wider variety of content types, including drawings, email messages, spreadsheets, videos, and other multimedia elements".

The revamp also includes a new version of Acrobat, as explained in a blog post by Adobe here.

Adobe applications have become a hacker favourite over recent years and frequently feature in malware attacks.

The addition of sandboxing technology is welcome even though it's certainly no panacea against exploits.

Oracle's Java Runtime Environment has long incorporated sandboxing. Despite this Java is more often successfully exploited to compromise PCs through drive-by download web exploits than Adobe Reader, according to new research from Microsoft.

Holly Stewart, a Microsoft security analyst, blames a huge upsurge in Java-based attacks recorded since Q3 2009 on attacks on three vulnerabilities, all of which have been patched. The upswing in attacks on Java has been going on for months, without much comment apart from the honourable exception of a blog post by Brian Krebs last week, possibly because IPS systems are not especially converse with Java, according to a theory suggested by Stewart.

Clearly this is an area that needs more research.

Patrik Runald, senior manager for security research at Websense, said more surfers ought to consider whether they actually needed Java. "Uninstall Java if you don't need it, it's the most attacked software by drive-by kits by far," he said. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.