Slashdot Mirror
Google Employees Find 60 Security Holes In Adobe Reader
sl4shd0rk writes "Upon examining the PDF Engine behind Google Chrome, Google employees Mateusz Jurczyk and Gynvael Coldwind discovered numerous holes. This led them to also test Adobe Reader, which turned up around 60 holes which could crash the PDF reader, 40 of them being potential attack vectors. The duo notified Adobe, who promised fixes, but as of the latest updates (Tuesday of this week) for Windows and Macintosh, 16 of the reported flaws are still present (the Linux version has been ignored). To prove it, Mateusz and Gynvael obfuscated the info and released it, saying the unpatched holes could easily be found. The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader."
PDFs have been a security headache for decades now. It originally started as an evolution of PostScript, but has since morphed into a "document solution". Adobe, like so many tech businesses, can't simply create a tool and then be finished. They always have to add more features, more code, more bloat. And surprise surprise, problems arise.
When I go to work on my car, I know my ratchets will work on any bolt on it; I just need to figure out what size it is and maybe an extender and I'm in business. My tools just work; they rarely break, and they don't stop working with next year's model... or the next decade's. Or the last. My ratchets will work on 1950s model cars, and I'm sure they'll still be useful on a 2050 model car.
Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work". What the fuck is so hard about making a read-only flat document that does the job of being easily readable and printable well? Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.
Be like the ratchet.
#fuckbeta #iamslashdot #dicemustdie
Google announces a new initiative: Google Document Format, for all your document sharing needs.
"Engineering is the art of making what you want from things you can get" - Jerry Avins
>Adobe in charge of security.
Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.
Give me Classic Slashdot or give me death!
Those fucking slackers could only find 60 holes in that Swiss cheese? And, they couldn't even bother looking at Flash!
Oops, I have to go. My PC needs to reboot after the third Flash and Reader update today.
I guess they just Googled it...
30 EUR for a single license for "PDF-XChange Viewer" and you get only "1 year of product maintenance" (which probably means after one year you need to pay for security patches).
For a freaking pdf reader? And with no real assurance that this one isn't again full of security holes. Get real.
Adobe is good ... at what the name suggests.
Upward mobility is a slippery slope - the higher you climb the more you show your ass.
I just removed it from my browser a while ago after I finally got sick of it crashing. I now use Okular to read PDFs and life is much better that way. I don't know why anyone would tolerate such a miserable plug-in.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The summary muddles two distinct PDF readers, the PDF reader built into the current version of Chrome (purely Google) and the PDF reader from Adobe that's completely separate. The Google reader is relevant only because the vulnerabilities in the Adobe reader were discovered using the tools developed to find vulnerabilities in Chrome.
30 EUR for a single license for "PDF-XChange Viewer" and you get only "1 year of product maintenance" (which probably means after one year you need to pay for security patches).
For a freaking pdf reader? And with no real assurance that this one isn't again full of security holes. Get real.
The 30EUR product is their Pro version (more like Adobe Acrobat Standard), they also have a free version which does everything Adobe Reader does and more.
Ahem
It's got commenting features without watermarking and even does OCR which I have been very impressed by.
Because it's a proper noun.
In Ubuntu (and probably other distributions and gnome based desktops) the default viewer is Evince, in KDE ones is Okular, and you have embedded viewers in other apps, like in google chrome. There is no need to install Adobe's unless you need some special added feature. A list of software that works with PDF can be found in Wikipedia
Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.
The Full Disclosure folks say that vulnerabilities should be disclose immediately. Their arguments have some merits. The Responsible Disclosure folks say that the vendor should have n number of weeks to get a patch out, then it goes to Full Disclosure. That has some merits as well, but the trouble is the public doesn't know there's a problem during the n weeks. The calculation is a balance of how many people will be protected vs. how many people will be harmed.
It occurs to me that a third way, call it 'Informed Disclosure' for now, would be to:
as a way to avoid the problem with Responsible Disclosure but still give the vendor reasonable time to react. e.g. 'Informed Disclosure' may say:
and then send Adobe the exploit code, which will be published in 45 days. This also removes the illusion of potential blackmail from security researchers, because the public has on-record information that the disclosure will be published, regardless of the action or inaction by the vendor.
Surely others have taken this approach, but I can't find a name attached to it -- anybody?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Not in recent years, in my experience.
http://www.acetonestudio.com
The javascript you can add to the PDF through a GUI or the javascript that you can embed into hex strings when writing a PDF file? The files are a hacky mix of text and binary. Some data types define their length, others have insane rules for end markers and escaping. Hex strings were originally pretty easy, but then they decided that they'd add javascript support into the parsing so you can constants that vary conditionally on the PDF version number. On top of that, you practically have to build a run time to render the PDF because of the complexity of its nested viewport stacks and viewport modifications that can be executed at any time in the PDF.
If that wasn't enough, they made it way more complicated when they hacked in support for JetForms (now known as LiveCycle), which is an XML language with poorly thought out data types and full of rendering hints that would be really useful if the documentation said more than "ignore these if you're not Adobe". If you want to save a PDF created with LiveCycle that a reader other than Acrobat can read, it's saved in both forms, resulting in a file that's 3x the size of a PDF.
Nothing here is new. I bet even the security findings
This is all a chrome advertisement.
"how to make people use our plugin instead of the free reader with lots of features?"
They only failed to realize that people that even uses pdf probably use "secret" for their email password
For saving my time, my sanity and the health of my PC, I've tried to avoid dealing with Adobe bloatware as much as I could. Under Windows most PDF can be opened instantly with Foxit. It's free, it's fast and it works for 99% of the files. I keep Acrobat Reader on my PC "just in case". I never open PDF files with the browser plugin (I disabled it), I prefer to download the file to the desktop and view it offline. It's faster and safer. I'm using an old version of Foxit with no builtin javascript support and which is blocked with the firewall. If it complains, that indicates the presence of a script, and most often it's malware (doing this way saved my skin a few times), or at least a script used for nefarious purpose like trying silently to report to headquarters. For creating PDF files from documents, PDFCreator is very easy to use and satisfy most of my needs, and to create PDF documents from scans I use WinScan2pdf. My last tool for manipulating PDFs is PDFTK (for which a GUI can be found). All these tools are free and easy to use.
The problem IMHO with Adobe is that their tool is flawed and they don't care. For example, their encryption, which they actually had someone put in jail for presenting a paper on, was identical to that used by Julius Caesar and a number of cut out codewheels for entertainment on the back of cereal boxes. It was a substitution code where each letter was replaced by a letter a set number of letters later in the alphabet - so solvable in under a minute by an average ten year old with one of those cereal box code wheels.
So that was one of their big secrets that Adobe insisted a man should be imprisoned for reverse engineering (Dmitry Sklyarov was held for several weeks before bail was granted). Of course a judge let him be released and go home to Russia a year before the full case over the suggested DMCA violation came to court, but it just shows how little Adobe really care about producing any sort of quality product and how much they care about their false front. They just care about milking their portion of a captive market instead of improving their products and, like Cisco last year, are not above abusing the legal system in a truly excessive way to hide their flaws.
If you're stuck on windows and are sick of Adobe and FoxIt (yes that's bloated now too), I recommend Sumatra. It's gotten really fast with launching and rendering now, and as a bonus will open your e-book formats which I find is a logical addition to a document viewer. As long as you don't actually need the Adobe magic forms, Sumatra is the better, sane solution to just view pdf's and similar.
https://dalgamotor.wordpress.com/ - Elektronik beyinlere ozgurluk asisi (Turkish)