Adobe bolsters Reader, Acrobat XI security
Updated Adobe Reader and Acrobat offer a better sandbox and new tools that can can block more attacks, Adobe says
IDG News Service - The recently launched Adobe Reader and Adobe Acrobat XI come with new security features and an improved sandbox that will make the products harder to attack and exploit, according to Adobe.
The sandboxing feature known as the Protected Mode that was first introduced in Adobe Reader X proved successful at mitigating traditional PDF exploits. The technology works by isolating certain Adobe Reader operations in a strictly controlled environment and makes it very hard for attackers to write and execute malicious code on a system after exploiting a vulnerability in the product.
"Since we added sandbox protection to Adobe Reader and Acrobat, we have not seen any exploits in the wild that break out of the Adobe Reader and Acrobat X sandbox," Priyank Choudhury, a security researcher within Adobe's Secure Software Engineering Team, said Wednesday in a blog post.
However, this doesn't mean that the Adobe Reader X sandbox can prevent all types of attacks. For example, the sandbox was primarily designed to restrict write operations, not read ones, which means that potential attackers can steal sensitive information from a system after exploiting an Adobe Reader X vulnerability.
That's no longer a problem in Adobe Reader XI, Choudhury said. "In Adobe Reader XI, we have added data theft prevention capabilities by extending the sandbox to restrict read-only activities to help protect against attackers seeking to read sensitive information on the user's computer."
"I've warned before that Adobe Reader X's sandbox is a write sandbox, e.g. that reading is still fully permitted and thus still allows stealing of information," Didier Stevens, a security researcher well known for his PDF security work, said Thursday via email. "I tested that."
Stevens assumes that the new sandbox model in Adobe Reader XI prohibits the reading of files and registry keys, but hasn't had a chance to test it yet. If that's the case, it would be an important improvement, he said.
The new version of Adobe Reader also comes with a Protected View mode that further strengthens the sandbox by creating a separate window station -- a separate securable clipboard and desktop -- for the PDF viewing process. This function is designed to block so-called screen-scraping attacks in which one application reads data from the display output of a different program running on the same desktop.
Adobe Acrobat already had a Protected View mode that has been enhanced in the new version. "Protected View behaves identically for Adobe Reader and Acrobat, whether viewing PDF files in the standalone product or in the browser," Choudhury said.
The support for Address Space Layout Randomization (ASLR), a memory-based anti-exploitation technology, has also been improved in the new Adobe Reader and Acrobat versions.
- Learn More About Peer 1 Hosting's Mission Critical Cloud Mission Critical Cloud from Peer 1 Hosting is enterprise-ready, creating a perfect point of adoption whether you need an off-premise solution for development
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- IPv6 Fundamentals IPv6 is needed to sustain the growth of the Internet. The transition from IPv4 will require planning and likely some degree of support...
- Optimize IT Performance & Availability: Four Steps to Establish Effective IT Management Baselines More than ever before, your company's ability to grow hinges on IT performance and availability. Download this how-to report on establishing IT baselines,...
- Live Webcast Master the Changing SAP Landscape with Performance Management SAP landscapes are not getting simpler. Gradually, business processes that used to be contained on a single SAP system now involve a range...
- Data Breaches - Don't Be a Headline Whether it's a HIPAA/HITECH, Sarbanes Oxley, Gramm-Leach-Bliley violation, or a State breach notification law, a data breach can have substantial legal and financial...
- Accelerate your innovation with IBM Bluemix™ Join us for a webcast introducing the new IBM BluemixTM. IBM Bluemix (www.bluemix.net) is a developer oriented Platform as a Service (PaaS) environment... All Applications White Papers | Webcasts