Feeds

Adobe: crashing 100 million machines not an option

Zero-day vulns get 6,000 man-hours of testing

Beginner's guide to SSL certificates

The vast majority of time Adobe spends patching zero-day vulnerabilities in its ubiquitous Reader and Flash Player applications is devoted to making sure the fixes won't cause catastrophic crashes on end-user machines, the company's security chief said.

“The last thing we want to do is ship a release that blue screens hundreds of millions of machines,” Brad Arkin, Adobe's senior director of product security and privacy, told people attending the Qualys Security Conference in San Francisco on Friday. He was referring to the blue screens many computers display after suffering serious software errors. “This would be truly awful. That is something we absolutely can never afford to happen.”

Photo of Brad Arkin

Adobe's senior director of product security and privacy, Brad Arkin

He said it takes Adobe developers anywhere from 20 minutes to eight hours to develop a patch once they've identified the code that's being exploited in an attack used to remotely install malware on end users' machines. The remainder of the time – typically about 6,000 man hours in the case of a fix for a zero-day vulnerability in Reader – is spent testing the new version on each operating system it runs on, to make sure there are no incompatibilities.

In early 2009, it took 10 weeks from the time Adobe learned a vulnerability was under attack to the date it shipped a fix. Since then, the company has worked on ways to shorten that span. It recently took the development team about 72 hours, a record, Arkin said.

With the vast majority of computers using Windows, OS X, Linux, and Solaris running Adobe software, there's a lot riding on the security of Flash and Reader. A previously unknown vulnerability in Flash was the beach head attackers used to penetrate RSA Security in March and make off with sensitive data that reduced the effectiveness of SecurID tokens that 40 million employees to access sensitive corporate and government networks.

Arkin said Adobe is also working to make it easier to install security patches. In the next several months, the company will introduce a new update mechanism for Flash that will upgrade the application for all browsers. Currently, Windows machines with more than one browser must be upgraded twice, once for Internet Explorer and again for the other browsers. Arkin said that behavior was a hold-over from the days when most users had slow internet connections and wouldn't tolerate larger file sizes that that would be required for an update that worked for all browsers. With faster connections now, that's no longer a problem.

“The more users in the consumer environment that get updated effortlessly, the less attractive the target is to the bad guys who are investing money in the exploit,” he said. “Staying up-to-date is really absolutely critical for our users.” ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.