Feeds

Adobe preps sandboxing tech to fight exploits

Play safe

Build a business case: developing custom apps

Adobe has fleshed out its plans to offer sandboxing as a mechanism to limit the impact of attacks against its ubiquitous Adobe Reader PDF reader application.

Available from November, Adobe Reader X will incorporate virtual sandboxing technology that will place controls on the application's ability to modify the registry or execute unwanted content.

Adobe Reader X Protected Mode is listed as one of six key improvements due in Adobe PDF application suite. Other enhancements include the ability for users to "view and interact with PDF files that contain an even wider variety of content types, including drawings, email messages, spreadsheets, videos, and other multimedia elements".

The revamp also includes a new version of Acrobat, as explained in a blog post by Adobe here.

Adobe applications have become a hacker favourite over recent years and frequently feature in malware attacks.

The addition of sandboxing technology is welcome even though it's certainly no panacea against exploits.

Oracle's Java Runtime Environment has long incorporated sandboxing. Despite this Java is more often successfully exploited to compromise PCs through drive-by download web exploits than Adobe Reader, according to new research from Microsoft.

Holly Stewart, a Microsoft security analyst, blames a huge upsurge in Java-based attacks recorded since Q3 2009 on attacks on three vulnerabilities, all of which have been patched. The upswing in attacks on Java has been going on for months, without much comment apart from the honourable exception of a blog post by Brian Krebs last week, possibly because IPS systems are not especially converse with Java, according to a theory suggested by Stewart.

Clearly this is an area that needs more research.

Patrik Runald, senior manager for security research at Websense, said more surfers ought to consider whether they actually needed Java. "Uninstall Java if you don't need it, it's the most attacked software by drive-by kits by far," he said. ®

Next gen security for virtualised datacentres

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?