Feeds

Adobe: crashing 100 million machines not an option

Zero-day vulns get 6,000 man-hours of testing

Security for virtualized datacentres

The vast majority of time Adobe spends patching zero-day vulnerabilities in its ubiquitous Reader and Flash Player applications is devoted to making sure the fixes won't cause catastrophic crashes on end-user machines, the company's security chief said.

“The last thing we want to do is ship a release that blue screens hundreds of millions of machines,” Brad Arkin, Adobe's senior director of product security and privacy, told people attending the Qualys Security Conference in San Francisco on Friday. He was referring to the blue screens many computers display after suffering serious software errors. “This would be truly awful. That is something we absolutely can never afford to happen.”

Photo of Brad Arkin

Adobe's senior director of product security and privacy, Brad Arkin

He said it takes Adobe developers anywhere from 20 minutes to eight hours to develop a patch once they've identified the code that's being exploited in an attack used to remotely install malware on end users' machines. The remainder of the time – typically about 6,000 man hours in the case of a fix for a zero-day vulnerability in Reader – is spent testing the new version on each operating system it runs on, to make sure there are no incompatibilities.

In early 2009, it took 10 weeks from the time Adobe learned a vulnerability was under attack to the date it shipped a fix. Since then, the company has worked on ways to shorten that span. It recently took the development team about 72 hours, a record, Arkin said.

With the vast majority of computers using Windows, OS X, Linux, and Solaris running Adobe software, there's a lot riding on the security of Flash and Reader. A previously unknown vulnerability in Flash was the beach head attackers used to penetrate RSA Security in March and make off with sensitive data that reduced the effectiveness of SecurID tokens that 40 million employees to access sensitive corporate and government networks.

Arkin said Adobe is also working to make it easier to install security patches. In the next several months, the company will introduce a new update mechanism for Flash that will upgrade the application for all browsers. Currently, Windows machines with more than one browser must be upgraded twice, once for Internet Explorer and again for the other browsers. Arkin said that behavior was a hold-over from the days when most users had slow internet connections and wouldn't tolerate larger file sizes that that would be required for an update that worked for all browsers. With faster connections now, that's no longer a problem.

“The more users in the consumer environment that get updated effortlessly, the less attractive the target is to the bad guys who are investing money in the exploit,” he said. “Staying up-to-date is really absolutely critical for our users.” ®

Beginner's guide to SSL certificates

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.