Feeds

Adobe: crashing 100 million machines not an option

Zero-day vulns get 6,000 man-hours of testing

Secure remote control for conventional and virtual desktops

The vast majority of time Adobe spends patching zero-day vulnerabilities in its ubiquitous Reader and Flash Player applications is devoted to making sure the fixes won't cause catastrophic crashes on end-user machines, the company's security chief said.

“The last thing we want to do is ship a release that blue screens hundreds of millions of machines,” Brad Arkin, Adobe's senior director of product security and privacy, told people attending the Qualys Security Conference in San Francisco on Friday. He was referring to the blue screens many computers display after suffering serious software errors. “This would be truly awful. That is something we absolutely can never afford to happen.”

Photo of Brad Arkin

Adobe's senior director of product security and privacy, Brad Arkin

He said it takes Adobe developers anywhere from 20 minutes to eight hours to develop a patch once they've identified the code that's being exploited in an attack used to remotely install malware on end users' machines. The remainder of the time – typically about 6,000 man hours in the case of a fix for a zero-day vulnerability in Reader – is spent testing the new version on each operating system it runs on, to make sure there are no incompatibilities.

In early 2009, it took 10 weeks from the time Adobe learned a vulnerability was under attack to the date it shipped a fix. Since then, the company has worked on ways to shorten that span. It recently took the development team about 72 hours, a record, Arkin said.

With the vast majority of computers using Windows, OS X, Linux, and Solaris running Adobe software, there's a lot riding on the security of Flash and Reader. A previously unknown vulnerability in Flash was the beach head attackers used to penetrate RSA Security in March and make off with sensitive data that reduced the effectiveness of SecurID tokens that 40 million employees to access sensitive corporate and government networks.

Arkin said Adobe is also working to make it easier to install security patches. In the next several months, the company will introduce a new update mechanism for Flash that will upgrade the application for all browsers. Currently, Windows machines with more than one browser must be upgraded twice, once for Internet Explorer and again for the other browsers. Arkin said that behavior was a hold-over from the days when most users had slow internet connections and wouldn't tolerate larger file sizes that that would be required for an update that worked for all browsers. With faster connections now, that's no longer a problem.

“The more users in the consumer environment that get updated effortlessly, the less attractive the target is to the bad guys who are investing money in the exploit,” he said. “Staying up-to-date is really absolutely critical for our users.” ®

New hybrid storage solutions

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.