Adobe bolsters Reader, Acrobat XI security
Updated Adobe Reader and Acrobat offer a better sandbox and new tools that can can block more attacks, Adobe says
IDG News Service - The recently launched Adobe Reader and Adobe Acrobat XI come with new security features and an improved sandbox that will make the products harder to attack and exploit, according to Adobe.
The sandboxing feature known as the Protected Mode that was first introduced in Adobe Reader X proved successful at mitigating traditional PDF exploits. The technology works by isolating certain Adobe Reader operations in a strictly controlled environment and makes it very hard for attackers to write and execute malicious code on a system after exploiting a vulnerability in the product.
"Since we added sandbox protection to Adobe Reader and Acrobat, we have not seen any exploits in the wild that break out of the Adobe Reader and Acrobat X sandbox," Priyank Choudhury, a security researcher within Adobe's Secure Software Engineering Team, said Wednesday in a blog post.
However, this doesn't mean that the Adobe Reader X sandbox can prevent all types of attacks. For example, the sandbox was primarily designed to restrict write operations, not read ones, which means that potential attackers can steal sensitive information from a system after exploiting an Adobe Reader X vulnerability.
That's no longer a problem in Adobe Reader XI, Choudhury said. "In Adobe Reader XI, we have added data theft prevention capabilities by extending the sandbox to restrict read-only activities to help protect against attackers seeking to read sensitive information on the user's computer."
"I've warned before that Adobe Reader X's sandbox is a write sandbox, e.g. that reading is still fully permitted and thus still allows stealing of information," Didier Stevens, a security researcher well known for his PDF security work, said Thursday via email. "I tested that."
Stevens assumes that the new sandbox model in Adobe Reader XI prohibits the reading of files and registry keys, but hasn't had a chance to test it yet. If that's the case, it would be an important improvement, he said.
The new version of Adobe Reader also comes with a Protected View mode that further strengthens the sandbox by creating a separate window station -- a separate securable clipboard and desktop -- for the PDF viewing process. This function is designed to block so-called screen-scraping attacks in which one application reads data from the display output of a different program running on the same desktop.
Adobe Acrobat already had a Protected View mode that has been enhanced in the new version. "Protected View behaves identically for Adobe Reader and Acrobat, whether viewing PDF files in the standalone product or in the browser," Choudhury said.
The support for Address Space Layout Randomization (ASLR), a memory-based anti-exploitation technology, has also been improved in the new Adobe Reader and Acrobat versions.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- The Critical Role of Support in Your Enterprise Mobility Management Strategy Most business leaders underestimate the importance of tech support when they choose an EMM solution. Here's what to put on your checklist.
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,...
- Getting Ready for BlackBerry Enterprise Service 10.2 Find out how BlackBerry® Enterprise Service 10 helps organizations address the full spectrum of EMM challenges, while balancing the needs of both the... All Applications White Papers | Webcasts