Slashdot Mirror
$50,000 Zero-Day Exploit Evades Adobe's Sandbox, Say Russian Analysts
tsu doh nimh writes with this excerpt from Krebs on Security: "Software vendor Adobe says it is investigating claims that instructions for exploiting a previously unknown critical security hole in the latest versions of its widely-used PDF Reader software are being sold in the cybercriminal underground. The finding comes from malware analysts at Moscow-based forensics firm Group-IB, who say they've discovered that a new exploit capable of compromising the security of computers running Adobe X and XI (Adobe Reader 10 and 11) is being sold in the underground for up to $50,000. This is significant because — beginning with Reader X — Adobe introduced a 'sandbox' feature aimed at blocking the exploitation of previously unidentified security holes in its software, and until now that protection has held its ground. Adobe, meanwhile, says it has not yet been able to verify the zero-day claims."
Has the average IQ of /. readers dropped so low recently that it became necessary to translate Roman numerals??
They can if they cough up 50 grand for a copy. By the way, is anybody getting sued for uploading a free torrent?
“He’s not deformed, he’s just drunk!”
Sorry, we cannot verify this zero-day exploit, the computer we tested it on isn't working right for some reason.
If I remember correctly, Flame was first identified by Kapersky, a Russian company. In this age wherein the US Government has a cyber-warfare division, it seems as though a large amount of the interesting, practical work in Computer Security is moving to Russia.
High time people stop using the Adobe pdf reader, and disable the "active hyperlinks" in it if it cant be fully uninstalled. Just in case some malware manages to trick the browser into using the installed adobe reader overriding the preference to foxit reader.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
In the new 11 version, you can no longer turn off the "view PDF in web browser" that basically frames it within your browser like a page without you ever approving it. So any rigged PDFs get loaded automatically. You used to be able to turn it off and only open PDFs via a file download prompt if a page is trying to serve one up.
How does the person paying $50,000 know he'll receive a working exploit and not, say, a .rar of the shareware version of Jill of the Jungle?
Adobe products are a security nightmare. It is 8 years behind even IE and XP! Just recently started signing apps? Just added a cutting edge feature called a sandbox a few months ago. Auto updates added just this year?? IE 7 had all of these.
No wonder hackers exploit this. It is a convenient way to byepass modern browser security that works across all platforms. No longer is it the case that using Firefox and going on familiar websites made you invincible. Just have unupdated flash or reader and BAM instant infection!
Anyway foxit does not execute code unless you tell it too. PDFs should only render data. Never execute flash or javascript! Flash can run without it being signed nor scanned by your AV or even sandboxed from within Reader X. Stupid. Whoever thought of that needs to be fired.
You can get Foxit from www.filehippo.com or ninite.com. Every IT professional should know about it.
http://saveie6.com/
I'm starting to wonder if Adobe even makes credible software these days. It's nice to be able to read documents and watch animations but do we really need all this software that seems to want to update twice a week and has a new security hole every month? How can development practice be so bad that we've ended up here? This just validates my idea that any piece of software on a PC needs to be the Windows OS or Microsoft code, and not vendor installed crap and bloat. I wouldn't trust them to write a "Hello World" app without at least 400 buffer exploits.
Alternatively, switch to Linux and avoid the whole problem.
As one who has used Adobe Reader since 3.0, it really is hard to comprehend why this product continues to advance in complexity. Are there strong numbers of users out there really using the advance features of Adobe X?
PDF is itself absolutely no security risk. It's wholly the crappy parsers/renderers. And the ability to include other insecure formats such as Flash. But nobody forces a viewer to spawn a Flash player and proper viewers such as evince just don't do that.