Feeds

Adobe preps sandboxing tech to fight exploits

Play safe

Top 5 reasons to deploy VMware with Tegile

Adobe has fleshed out its plans to offer sandboxing as a mechanism to limit the impact of attacks against its ubiquitous Adobe Reader PDF reader application.

Available from November, Adobe Reader X will incorporate virtual sandboxing technology that will place controls on the application's ability to modify the registry or execute unwanted content.

Adobe Reader X Protected Mode is listed as one of six key improvements due in Adobe PDF application suite. Other enhancements include the ability for users to "view and interact with PDF files that contain an even wider variety of content types, including drawings, email messages, spreadsheets, videos, and other multimedia elements".

The revamp also includes a new version of Acrobat, as explained in a blog post by Adobe here.

Adobe applications have become a hacker favourite over recent years and frequently feature in malware attacks.

The addition of sandboxing technology is welcome even though it's certainly no panacea against exploits.

Oracle's Java Runtime Environment has long incorporated sandboxing. Despite this Java is more often successfully exploited to compromise PCs through drive-by download web exploits than Adobe Reader, according to new research from Microsoft.

Holly Stewart, a Microsoft security analyst, blames a huge upsurge in Java-based attacks recorded since Q3 2009 on attacks on three vulnerabilities, all of which have been patched. The upswing in attacks on Java has been going on for months, without much comment apart from the honourable exception of a blog post by Brian Krebs last week, possibly because IPS systems are not especially converse with Java, according to a theory suggested by Stewart.

Clearly this is an area that needs more research.

Patrik Runald, senior manager for security research at Websense, said more surfers ought to consider whether they actually needed Java. "Uninstall Java if you don't need it, it's the most attacked software by drive-by kits by far," he said. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.