Adobe Putting PDF Reader In a Sandbox

Captain Eloquence writes "The next major version of Adobe's PDF Reader will feature new sandboxing technology aimed at curbing a surge in malicious hacker attacks. The initial sandbox implementation will isolate all 'write' calls on Windows 7, Windows Vista, Windows XP, Windows Server 2008, and Windows Server 2003. Adobe security chief Brad Arkin believes this will mitigate the risk of exploits seeking to install malware on the user's computer or otherwise change the computer's file system or registry. In a future dot-release, the company plans to extend the sandbox to include read-only activities to protect against attackers seeking to read sensitive information from the user's computer."

Comments

They should put it in the trashbox

[Joe Snipe]

That piece of bloatware should be put on a harsh diet before that.

Finally..

[Anonymous Coward]

It appears Adobe finally realized that a document reader shouldn't have access to my entire sysetm.

Re:Finally..

[Anonymous Coward]

It really amazes me that anyone could successfully get acrobat to install malware. I can barely get it to view PDFs. perhaps acrobat should hire some of these malware writers to get acrobat to stop crashing on every windows and linux box I've ever used for the past 10 years.

Question

[wonkavader]

Why does a PDF viewer need to give the document the ability to write at all?

Would ripping some of the crazy features out of the PDF spec solve this more completely and reasonably?

What do we use PDFs for which involves writes?

Re:Question

[sconeu]

In a PDF Writer, yes. In a PDF *VIEWER*, no.

Re:Question

[rudy_wayne]

Signing documents, adding notes, adding addendum, filling out forms, etc. There is more to PDF's then text.

It's called Acrobat READER and it is supposed to be for READING PDF files. It is completely inappropriate for it to be able to WRITE anything. Adding extra crap is the reason that it has so many security flaws.

Re:Question

[H0p313ss]

Signing documents, adding notes, adding addendum, filling out forms, etc. There is more to PDF's then text.

It's called Acrobat READER and it is supposed to be for READING PDF files. It is completely inappropriate for it to be able to WRITE anything. Adding extra crap is the reason that it has so many security flaws.

Indeed... the write capabilities should be completely disabled until they are turned on by the user. Even better would be a "Reader Light" with no write capability at all for the 99% of users who will never use Acrobat to complete a form.

Re:Question

[nine-times]

With Acrobat, Adobe has fallen into a particular bloat trap usually reserved for Microsoft and AV vendors. It goes like this:

You release a product, and it does one specific thing well. Lots of people buy it, and you have a success on your hands. You come up with a bunch of fixes and new features, and release version 2. Again, lots of people buy it. Same thing again with Version 3, maybe version 4... and so on. This is the normal ideal for-profit software development model.

However, at some point you start developing what will become... let's say version 5. You start working on it, and you can't think of any good features to add in. Version 4 already does everything you want that software to do, but you can't just stop there-- you wouldn't be able to sell any upgrade anymore. At the same time, you can't just release bug-fixes and improve performance, since you wouldn't be able to justify charging people for a new version that consisted only in bug fixes. You don't want to head in an entirely new direction because it might alienate current users. You don't want to invest in creating a new product instead, because new products are risky. You just want to find a way to continue milking your cash cow.

Eventually you come up with a bunch of flashy-sounding features that you can advertise even if almost no one uses them. You invest in marketing to make people feel like this new version will allow them to do lots of things that they'll probably never actually do. You reorganize the interface, shifting controls around for no reason other than to make things look "new". You discontinue support for older versions. You modify your file formats so that they'll be slightly incompatible with older versions, or at least you make sure your older versions throw up some kind of warning that says, "This document was made with a newer version. Upgrade now!"

You do a whole bunch of that stuff, and sure enough, people buy it. You set out to make version 6, and you find yourself in approximately the same bind. Some people are still happily using version 4 of your software, and you haven't been able to convince them to upgrade. So then you start throwing even more powerful-sounding but useless features at your customers. "This version has SecureBit technology, which will make all of your bits secure. Make sure you upgrade, or all your information will be eaten by hackers!" and "This version has the latest support for the latest AwesomeX technology. Make sure you upgrade, or you'll find out your friends can do cool things that you can't!" Little by little, you push customers to the latest version. This is now your business model.

With each version, you throw in more and more stuff. Maybe some of it's useful. Maybe there are even 2% of your customers that actually make good use of AwesomeX technology. Mostly, though, your software gets more and more bloated with stupid things so that you have an excuse to keep charging money.

Ultimatley PDF have been fine for making print documents for a long time. Acrobat and Acrobat Reader have improved in some ways, but even old versions were adequate for producing static PDFs. Adobe's only hope for continued growth is to push PDF to be used for more and more things that it is not well suited to handle. Adobe has made it so each PDF file can be kind of like its own stand-alone application by using javascript and Flash.

Re:Question

[Gnavpot]

Signing documents, adding notes, adding addendum, filling out forms, etc. There is more to PDF's then text.

Uhm, if this was the functionality discussed here, Notepad and vi would be just as vulnerable.

You are clearly confusing:

1. A program which saves changes to the loaded file when the user requests it.

2. A program which writes to other files in the file system, when the document requests it.

The problem with Adobe Reader is #2, not #1. So, to repeat the GP's question:
Why does a PDF viewer need to give the document the ability to write at all?

Desperation

[jridley]

Honestly, give up on Adobe Reader. There are other options. FoxIt has about the same feature set, and CAN do all the dangerous boneheaded stuff like embedded javascript and external execution, but by default it's off, and the vast majority of people never need that stuff.

On the skinny end there's Sumatra (too skinny for me, no browser plugin). At the other end is Nitro PDF, which has a TON of features even in the free version.

Honestly, just take Adobe reader right off your machine. Do it now.

Doesn't matter

[MadGeek007]

A sandbox doesn't matter if said sandbox has as many flaws as the orignal reader...

Re:Doesn't matter

[spazdor]

goodbye, PDF->payload

hello PDF->chroot breaker code->payload

How do you keep stuff like tidserve out.

[rsilvergun]

TIDserve gets right past virtualization. It uses a privilege escalation in IE to find the virtual OS' drivers and then it follows the driver chain down to atapi.sys (which it can exploit).

This reminds me of Word Macros

[Lord Byron II]

It seems that Microsoft already went through this 15 years ago with Word macros. It's kind of scary that these companies that are producing software for looking at / creating documents would enable this sort of functionality in their file formats. I realize that there are a handful of applications where it's beneficial to have a document be able to write to the filesystem, but for 99.99% of documents, what business do they have reading or writing anything?

It would be like if you bought a book, sat it down on your desk, and when you pick it up later, you find that the book was doodling on your desk the whole time.

Re:software noob but...

[king neckbeard]

There are good practices for security to minimize security risks, but nobody at Adobe has ever heard of them.

Re:Who needs it?

[plasticsquirrel]

"I don't use Adobe Reader, so why would anyone else need to? Why can't everyone just change to something else?"

Sorry, but the vast majority of users have Adobe Reader installed to view PDF files, and they will not know why or how they should change to something else. Add to that the fact that the security of shitty-but-popular popular affects us all by proxy, and these things really do matter.

It's like saying, "Well, I don't care about malicious JavaScript and ActiveX in Internet Explorer, because I use Firefox on Linux. Who needs that other crap?" Most other people are just going to use default garbage, and the entire Internet is impacted by this.

Still, there are always Slashdot posts in the vein, "I don't use software X, I use software Y, so it doesn't matter." It's a naive and self-centered view of the world that unrealistically assumes that because a particular geeky reader found a way around a problem, that it has ceased to become a problem, or that the entire world should then follow this in emulation. Wake up, the world is bigger than the basement you inhabit.

Re:And yet they still haven't made a version...

[Anonymous Coward]

Why would 32-bit libraries cause stability issues? Other applications wont use them if they're already 64-bit. If its Acrobat iself having stability issues, a 64-bit version wouldn't help most likely. .

But what will they put the sandbox in?

[kindbud]

Just sayin'...

Re:Who needs it?

[bit9]

Sounds like you're overreacting a bit. The OP's comment sounds to me like a reasonable suggestion that would probably fit the needs of a significant percentage of Adobe Reader users. A solution doesn't have to be completely general in order to be useful.

Re:Sandbox

[rahvin112]

And Apple Stole every aspect from the XEROX PARC development. They guy credited with creating the GUI and Mouse worked for Xerox, not Apple. Xerox let them steal it, no question, but don't give credit where it's not due, PARC is responsible for far more than what you are crediting to Apple. The only thing Apple did was make these software interfaces cost effective by using commodity hardware instead of PARC'a tendency to use specialty hardware.

PDF Programming Platform

[Anonymous Coward]

The initial sandbox implementation will isolate all 'write' calls on Windows 7, Windows Vista, Windows XP, Windows Server 2008, and Windows Server 2003...

I was always perplexed at how a text document can somehow make calls to an operating system. It seems to be that PDF is a programming interface that supports text, and not a document format.

Re:Operating System Feature

[gad_zuki!]

Windows 7 and Vista offer protected mode to any developer who wants to use it. Acrobat doesn't currently use it but other applications do and it seems they'd rather roll their own sandbox, which is fine, but the mode is available as an OS feature. This is separate from running as a limited user or enabling the UAC, both of which can be done on top of it.

Re:I need it.

[Khuffie]

"Yeah, hi. Can you please change your workflow and the way you've been doing things for years that has worked with no problems just because I can't be bothered installed a free program to open your PDF files? Thanks!"

Re:Who needs it?

[xmorg]

Yea, isn't that kind of the point of PDFs? To be able to view the same document on any machine just as if it were printed?
If you are making a PDF that can only be read in the latest version Adobe acrobat reader, you might as well use the docx format lol.