Feeds

Adobe: crashing 100 million machines not an option

Zero-day vulns get 6,000 man-hours of testing

Choosing a cloud hosting partner with confidence

The vast majority of time Adobe spends patching zero-day vulnerabilities in its ubiquitous Reader and Flash Player applications is devoted to making sure the fixes won't cause catastrophic crashes on end-user machines, the company's security chief said.

“The last thing we want to do is ship a release that blue screens hundreds of millions of machines,” Brad Arkin, Adobe's senior director of product security and privacy, told people attending the Qualys Security Conference in San Francisco on Friday. He was referring to the blue screens many computers display after suffering serious software errors. “This would be truly awful. That is something we absolutely can never afford to happen.”

Photo of Brad Arkin

Adobe's senior director of product security and privacy, Brad Arkin

He said it takes Adobe developers anywhere from 20 minutes to eight hours to develop a patch once they've identified the code that's being exploited in an attack used to remotely install malware on end users' machines. The remainder of the time – typically about 6,000 man hours in the case of a fix for a zero-day vulnerability in Reader – is spent testing the new version on each operating system it runs on, to make sure there are no incompatibilities.

In early 2009, it took 10 weeks from the time Adobe learned a vulnerability was under attack to the date it shipped a fix. Since then, the company has worked on ways to shorten that span. It recently took the development team about 72 hours, a record, Arkin said.

With the vast majority of computers using Windows, OS X, Linux, and Solaris running Adobe software, there's a lot riding on the security of Flash and Reader. A previously unknown vulnerability in Flash was the beach head attackers used to penetrate RSA Security in March and make off with sensitive data that reduced the effectiveness of SecurID tokens that 40 million employees to access sensitive corporate and government networks.

Arkin said Adobe is also working to make it easier to install security patches. In the next several months, the company will introduce a new update mechanism for Flash that will upgrade the application for all browsers. Currently, Windows machines with more than one browser must be upgraded twice, once for Internet Explorer and again for the other browsers. Arkin said that behavior was a hold-over from the days when most users had slow internet connections and wouldn't tolerate larger file sizes that that would be required for an update that worked for all browsers. With faster connections now, that's no longer a problem.

“The more users in the consumer environment that get updated effortlessly, the less attractive the target is to the bad guys who are investing money in the exploit,” he said. “Staying up-to-date is really absolutely critical for our users.” ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.