Dear Adobe: It's time for security rehab
This is an intervention
Comment The stories about Adobe software keep coming, and the news hasn't been good. Critical bugs in Reader and Flash have come under real-world, zero-day attacks so many times in the past year that the exploits almost seem routine.
Security researchers such as Mike Bailey, Dan Kaminsky and Jeremiah Grossman and Robert "RSnake" Hansen have been exposing architectural flaws in Adobe Flash for years that compromise the safety of the entire internet, and yet many of them remain unfixed to this day. Even Apple boss Steve Jobs has turned sour on Adobe, proclaiming recently that when Macs crash "more often than not it's because of Flash."
The last straw came on Wednesday, when two researchers independently came up with separate attacks that pierce important memory protections Microsoft built to minimize the severity of security bugs contained in both home-grown and third-party applications that run on Windows. It was as if Adobe had sawed huge holes in a fairly effective safety net that Redmond went to considerable lengths to construct to keep its users safe.
It's against this backdrop that we propose that Adobe borrow a page from Toyota, another company facing a public relations crisis resulting from dangerous defects in its products. The steady stream of stories about broken acceleration pedals that cause drivers to lose control proved so damaging that the world's No. 1 car maker took the unprecedented step of taking eight top-selling models off the market until the hazard could be corrected. On Thursday, it went a step further, recalling 270,000 Priuses for unrelated brake problems.
Adobe needs to follow suit. Now.
Like Microsoft eight years ago, Adobe engineers should drop everything else and instead attend mandatory classes on secure development practices. Every line of code should be audited by an outside firm, and the programs should be rigorously subjected to fuzzers and other analysis tools. And while we're at it, Adobe should call a moratorium on all mergers and acquisitions, unless they add to its security muscle.
To be sure, this medicine wouldn't be easy for investors or employees to swallow, but it's for their own good. Besides, if the company can afford $1.8bln to expand into web analytics, it should be expected to spend equally princely sums to keep its considerable user base safe.
Last May's initiative by Adobe to beef up security of Reader and Acrobat was a step in the right direction, but details released to date suggest the effort is woefully inadequate. Mainly, that's because it focuses on only those two applications, rather than taking a more holistic approach, or at the very least including Flash.
Instead, like their counterparts at Toyota, Adobe executives need to admit they have a safety problem on their hands that's of epic proportions. It's time to suspend all elective development of Reader, Acrobat, and Flash for a set period of time - nine months to a year sounds right to us - and devote that time to identifying and repairing the considerable number of cracks in their foundations.
But most of all, it's time to stop the head-in-the-sand denials, like the one we got earlier this week from Adobe CTO Kevin Lynch, who protested a bit too loudly that his company would never "ship Flash with any known crash bugs." Rather breathtakingly, he insisted that "if there was such a widespread problem historically Flash could not have achieved its wide use today." As if the Ford Pinto, Chevy Corvair, or indeed the Toyota Camry didn't gain popular acceptance as well.
A comprehensive SDL, or secure development lifecycle, should also be undertaken, if Adobe wants to win back our trust.
Yes, it's asking a lot, but enough is enough. A suspension of business as usual seems to be the only way to correct what appears to be structural flaws that imperils us all. Just ask Toyota. ®