Adobe: Hacker 'spotlight' will shine on Reader X's sandbox
But firm's security exec is certain the sandbox will make PDF attacks passé
Computerworld - Adobe's chief security executive said that there will be a bull's-eye on Reader X when the new version ships next month.
Adobe Reader X, slated for release in the next 30 days, will feature Protected Mode, a "sandbox" technology that isolates processes, preventing or at least hindering malware from escaping an application to wreak havoc on the computer.
Security researchers and experts have long called for Adobe to add sandboxing to Reader because of its many vulnerabilities, which have made it a popular route to PC infection. They're getting what they asked for in November.
But Brad Arkin, Adobe's director of security and privacy, acknowledged that Protected Mode won't stop attacks against the popular PDF viewer. In fact, it will probably encourage researchers to redouble their efforts to identify security holes, at least initially.
"We're going to have the spotlight of the security researcher community on us when Reader X launches," Arkin said. "Everyone will want bragging rights to be the first to come up with a working exploit of the sandbox."
But Arkin was confident that Reader X will withstand the inevitable assaults.
"We have a lot of confidence that we've leveraged the positive aspects of the best technologies," he said, referring to the work on sandboxing by both Google and Microsoft that Adobe used to construct its defenses.
In Reader X, all PDF rendering chores will take place within the sandbox, which severely limits the application's privileges in order to cut it off from the rest of the system. Any malicious code packed into a rogue PDF would still run, but it should not be able to escape the isolation chamber.
A separate "broker" decides which functions Reader can conduct outside the sandbox, such as writing to disk or launching an attachment or executable file from within the software.
The key to Protected Mode, Arkin acknowledged, is the broker. Hack the broker, and attackers will still be able to infect machines using rigged PDFs.
"The broker is 13,000 lines of code -- brand-new modern code that's been exhaustively tested and gone through Secure Product Lifecycle," said Arkin, referring to Adobe's development strategy that, like Microsoft's better-known Software Development Lifecycle, mandates that programmers follow security-specific steps to reduce possible vulnerabilities.
"That code has had more security attention than any other like-sized code in the history of the company," Arkin said. "We've had multiple sets of eyeballs on it to make sure we didn't have groupthink going on here."
Adobe tested the broker specifically and the sandbox in general, both inside the company and with a limited number of enterprise customers that use Reader. The company also hired outside researchers, who tried to break out of the sandbox, but Arkin declined to specify the results.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Building a Bridge to the Next Generation Data Center Selecting a widely adopted operating system is a foundational component of a standardization strategy.
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,...
- Getting Ready for BlackBerry Enterprise Service 10.2 Find out how BlackBerry® Enterprise Service 10 helps organizations address the full spectrum of EMM challenges, while balancing the needs of both the... All Applications White Papers | Webcasts