An anonymous reader writes "According to the TrustedSource Blog, malware authors increasingly target PDF files as an infection vector. Keep your browser plugins updated. From the article: 'The Portable Document Format (PDF) is one of the file formats of choice commonly used in today's enterprises, since it's widely deployed across different operating systems. But on a down-side this format has also known vulnerabilites which are exploited in the wild. Secure Computing's Anti-Malware Research Labs spotted a new and yet unknown exploit toolkit which exclusively targets Adobe's PDF format.'"
I was wondering whether there was any hope of getting websites to start saying "requires a PDF reader" instead of "requires Adobe's PDF reader". The non-Adobe readers I've used have pretty much all rendered docs fine and twice as quickly to boot.
I've been using Foxit exclusively for some time now.
There's nothing about Adobe Reader that I miss. Foxit seems to handle everything I come across just fine. And it's way faster and never crashes. Adobe Reader seemed to crash on me all the time on multiple machines.
Yeah, but there was already a buffer overflow security fix a little while back. I am using Foxit too because I finally got sick of Adobe when they wanted to install some Flex or god awful runtime and phone home constantly. Adobe has gotten stupid.
Time for a "Firefoxpdf" kind of thing. Foxit is it for me. Hope it doesn't have any more buffer overflows, but I bet it does.
I think Adobe calls shutdown.exe on windows for a reboot. Usually I say reboot later and use the thing right away. Most times I do not need to reboot. Sometimes (lastest version) it complains that I need to reboot in order to use the software.
I use Apple's Preview/display PDF. The only time I've needed to use Acrobat was for filling out IRS tax forms (Preview didn't save the data I entered).
I use kpdf, and it works great for almost all PDFs. The only problem I have with it is PDFs that have fillable forms; I haven't found an open-source PDF viewer that can do that yet, so I usually use Adobe Reader or some German-made closed-source program whose name escapes me at the moment (I believe it starts with "C").
Most PDF files have nothing more than text, vector graphics, and images in "read-only" formats. They don't have fill-in-the-blank fields or load-a-codec-and-play-a-video, or active content.
Web browsers need a "simple PDF" plugin that will activate on PDFs. If the "simple PDF" plugin loads a file with content it can't display, it will display what it can and give the user an opportunity to load the file in a full-fledged PDF plugin or external viewer.
And don't forget to not only patch the latested operating system and browser vulnerabilities, but also keep an eye on third-party browser plugins like Adobe Reader, Flash Player and QuickTime.
Why do all these security articles end up basically saying the same thing?
Patch & update, rinse, repeat.
Everything else in these security/warning articles just show you what happens to the people who never patch anything and open anything & everything.
Wouldn't that describe PostScript better? And even Microsoft's XPS! PDF was pretty much always doing too much IMO... but its what caught on, meh. The features it provides are very very useful. Just not so useful in non-trusted environments.
Postscript can contain function calls and as such, is often marked as a potential scripting threat. Google, for example, refuses to send raw eps files as attachments.
A similar principle to Windows MetaFile, which is essentially a list of calls to the Windows graphics library ; several Windows exploits owe their birth to WMF calling unchecked functions in the graphics library.
Note that just because a file format doesn't contain function calls or scripting does not make it secure. A poor implementation of any file reader can be vulnerable to a well crafted file. But active content makes things much easier, because it's much harder to check for security.
by Anonymous Coward
on Tuesday September 23 2008, @09:03AM (#25119731)
Use the Sumatra PDF Reader. It is a very lightweight reader. Since it doesn't have all the other useless bloat crap that Adobe's reader has, I'm sure it is a lot less vulnerable. It is also open source, so you don't have to rely on downloading an even more bloated version of Acrobat Reader to fix the exploits.
http://blog.kowalczyk.info/software/sumatrapdf/
I have this installed on all of the PCs here at the office. It has eliminated just about all of the issues i had with the adobe crapware.
PDF is essentially a compressed, higher ability Postscript, right? Postscript is a language, and that therefore would be how malware writers exploit it--they exploit bugs in the readers, which are essentially compilers--to compromise a system.
PDF is essentially a compressed, higher ability Postscript, right?
On the contrary, PDF is (originally) a subset of PS plus the ability to embed fonts into the document, apply some overall compression where sensible, and stitch everything together into one carrier.
And while it is true that the past knows about "PS bombs" which e.g. will render your printer useless cause its interpreter is stuck in a loop (after all, PS is a Turing-capable programming language opening all sorts of fun if your idea of fun are stack-oriented languages), the problem with current PDF exploits comes from the fact that this format gets increasingly overloaded.
I can see why one would love to see Javascript and embedding all kinds of multimedia stuff within PDF. Would bring PDF on par with Powerpoint with respect to animations etc. -- which wouldn't be the worst thing for me, cause I love doing slides with PDFtex and beamer, and Adobe of course would like to present their format as a vital alternative to those nasty office formats.
But it also adds complexity. Instead of a simple postscript renderer you end up with a gazillion of helper libraries, bringing in their very own bugs.
Interestingly enough, I have gotten 3 PDFs in the past few days in my corporate email inviting me to various "seminars" on technology subjects. All were very well written and professional looking but for products I have never used and companies I had not heard of. They passed both my email server's scanning and the local virus scan on my company laptop, however since I have very rarely gotten PDFs in the past I am now very suspicious.
Exploit the Windows operating system cause the majority of users have it. Exploit Internet Explorer because the majority of users have it. Exploit Office products because the majority of users have it. Exploit Adobe's PDF format because the majority of users have it.
There is now Mac OS, various Linux distros, etc. There is FireFox, Opera, Chrome, etc. There is Open Office, etc. Maybe Adobe needs some good competition in the eyes of the public?
When I used to use Windows, I found Acrobat to be the most intrusive software ever because of its auto-update. Pretty much every time you try to open a document it's in your face demanding you allow it to update itself and then it often requests a reboot (a reboot? For a PDF viewer??)
This seemed to happen every other week, even if appeased it by letting it do its thing. I suspect this update would be one possible attack vector.
Yet another case in which a "fuck off" key would be a useful addition to the Windows keyboard.
The biggest issue is overuse and inappropriate use of PDF.
The only reason to ever use PDF is if it is NECESSARY for your audience to print the document in question.
Way too often websites have PDFs that are the only alternative for information. If you want to look up a train time for example, once and once only, you almost always have to download a PDF -- why? Sure, give people the choice of doing that if they want to, but there's no reason to slow down the internet for one-off pieces of information.
With concerns about the environment (perceived real or theatrical, regardless), you'd think that firms would stop encouraging frivolous use of paper. With the extortionate cost of printer ink, you'd think that firms would also be cost-conscious.
Uploading a 2 or 3 page document to the web in a PDF format is a criminal waste of resources, it's also an irritation that I don't need. I do not (and will never) work in a corporation. I do not need Office or PDF format -- ever. It's slow, and it's crap to read online.
I can cheerfully live my entire life without it, and I sincerely wish retarded developers and content managers would stop forcing it on me.
Often, the reason for this is that either 1) the document in question was first designed for a print medium, or 2) The material was dumped from some kind of database as PDF. Often to redesign the output to be a better in web format is nontrivial. Why should they waste so many workhours on such a thing? It would provide no benefit in terms of the information that is available. It would only keep you from being annoyed.
Given that many of the organizations doing this are government organizations, and they use tax dollars, do you want your tax dollars spent on just redesigning output to be appropriate for HTML? I'll just deal with the (small) annoyance, thanks.
Any format can be exploited. The (over)use of PDF is not the issue here.
Additionally, plenty of academic papers, presentations, and posters are written with LaTeX. I would rather see people posting such material to the web (in PDF), rather than the alternative of not posting it, or spending time fighting to convert things to HTML and having it look awkward.
Firefox should ship with some minimal PDF reader instead of Adobe's. There's an incredible amount of junk in Adobe's PDF reader, which adds both vulnerabilities and load time. Has anyone ever used the WebBuy feature of Adobe PDF Reader?
Not disagreeing here but you might like to know there is a common habit of disabling the loading of all the plugins in adobe. I forget how it is best done, but a cheap trick is renaming the plugin directory.
1. Has a tendency to make your browser freeze up 2. Tries to infect some sort of TSR in Windows called Acrord32 3. Will frequently pop up a "checking for updates" dialog 4. Makes the fastest of computers slow to a crawl. 5. a super-jumpy scrolling interface
No wait, those aren't malware symptoms, that's just in Adobe's product. Next week we will discuss the incredible annoyances of the "java runtime environment" daily annoyances & clog-ups in "Add/Remove Programs". Do ANY software vendors know how annoying their software can be at times? Even Apple is guilty of forcing add-on installs you have no choice to get out of.
I'm sorry, but in that very brief article linked, I saw absolutely ZERO analysis concerning frequency.
YAY! There's an exploit and toolkit. The existence of which is, in some sense, a useful piece of prior information for establishing the probability that there MIGHT BE an increase in frequency in the future - but it's quite a leap to have a freakin'/. link to a corporate article that uses hyperbole in claiming that there is some State of Nature or State of Knowledge that points to.pdf attacks being "On the rise".
No, it's just that for some people PDFs are a hammer and every single printed word on the tubes is a nail.
I have had plenty of times where I was turning in papers electronically or needed to transfer documents between computers where PDF came in quite useful. When I'm turning in a paper electronically, I have no idea what version of Office the professor has. Nor do I even have Office. PDFs are very useful in this case.
Also, it may not be as bloated as you perceive. Acrobot reader is slow as hell. Evince and KPDF, both on Linux, are noticeably faster for me. There are alternatives for Windows as well that are better than the "official" reader.
As a university professor, I actively encourage my students to use PDF files if possible. OS X and Linux come with PDF output, and I'm sure there's a way to do it in Windows without paying Adobe.
I also specifically PROHIBIT MS Office 2007/2008.docx,.pptx,.xlsx,.xlwx, etc. formats. I'm not paying for an "upgrade" that completely changes the UI and introduces a new format without providing any real benefit to me.
Yes, I accept OpenOffice.org documents (as well as.dvi,.ps, and the formats from iWork)
For Windows the best (and free/open source) tool I've found is PDFCreator [pdfforge.org]. It installs a "printer" on your computer that outputs to PDF. Using PDFCreator, you can make a PDF in any application that allows you to print. Using some of the "advanced" features (not really advanced, but slightly more complex than Print->PDF), you can even combine multiple print-outs from different applications into a single PDF.
MS has always offered free Office document viewers, since the early Jurassic. But, don't tell your students that. Get them used to PDFs while you have some authority!
I'll look into it, but the last time I tried the one for OS X it didn't work. It caused major problems with the formatting of the document, amongst other things. (And I have Office 2004 installed on my machine.)
Actually, that only works for documents that you can view/edit in Open Office. For general purpose use, you can always opt for PDFCreator [sourceforge.net]. We use it at our clients' offices, and have excellent results.
There are alternatives for Windows as well that are better than the "official" reader.
Specifically Sumatra PDF [kowalczyk.info] and Foxit Reader [foxitsoftware.com] are alternative PDF readers for Windows.
They are both orders-of-magnitude faster than Adobe Acrobat. Part of the reason for this speed boost is that they don't implement the hundreds of plug-ins that Acrobat supports. But frankly for >99% of the PDFs you encounter, those additional plug-ins are not required. (In the rare case where a PDF needs one of those features, I guess you can load up Acrobat.)
In addition to a speed advantage, using an alternate PDF reader is probably more secure. Both because it is less well-known (fewer exploits tailored to it), and because they don't implement those hundreds of plug-ins (some of which enable certain kinds of code execution).
Not to worry. (Score:5, Insightful)
I'm sure Secure Computing has a product for that. :-/
Re:Not to worry. (Score:5, Insightful)
Don't set your browser to auto-load PDF files. (Or any other file for that matter.) Download it first; scan it; then open it externally.
Parent
Re:Not to worry. (Score:5, Insightful)
Or don't use Adobe Reader, instead use one of the many competent and more secure open alternatives.
Parent
Re: (Score:2)
I was wondering whether there was any hope of getting websites to start saying "requires a PDF reader" instead of "requires Adobe's PDF reader". The non-Adobe readers I've used have pretty much all rendered docs fine and twice as quickly to boot.
Re:Not to worry. (Score:5, Insightful)
This is only going to happen after this kind of thing is called an "Acrobat Reader exploit" rather than a "PDF exploit" though.
Parent
Re:Not to worry. (Score:5, Informative)
I've been using Foxit exclusively for some time now.
There's nothing about Adobe Reader that I miss. Foxit seems to handle everything I come across just fine. And it's way faster and never crashes. Adobe Reader seemed to crash on me all the time on multiple machines.
Parent
Re: (Score:3, Informative)
Re: (Score:3)
Yeah, but there was already a buffer overflow security fix a little while back. I am using Foxit too because I finally got sick of Adobe when they wanted to install some Flex or god awful runtime and phone home constantly. Adobe has gotten stupid.
Time for a "Firefoxpdf" kind of thing. Foxit is it for me. Hope it doesn't have any more buffer overflows, but I bet it does.
Re: (Score:3, Interesting)
The rendering quality of Foxit is sub-par, try SumatraPDF which is open-source. The visual quality is much better.
Re: (Score:3)
I think Adobe calls shutdown.exe on windows for a reboot. Usually I say reboot later and use the thing right away. Most times I do not need to reboot. Sometimes (lastest version) it complains that I need to reboot in order to use the software.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Evince works flawlessly for me.
Re: (Score:3, Insightful)
And missing features.
Like script execution turned on by default.
Nothing could go wrong there.
Re: (Score:3, Informative)
Foxit [foxitsoftware.com] FTW.
Re: (Score:3, Insightful)
oh, you mean the inability to start up in less than a minute? or the ability to act as a virus vector?
Re: (Score:3, Informative)
I use kpdf, and it works great for almost all PDFs. The only problem I have with it is PDFs that have fillable forms; I haven't found an open-source PDF viewer that can do that yet, so I usually use Adobe Reader or some German-made closed-source program whose name escapes me at the moment (I believe it starts with "C").
Time for PDF Lite? (Score:5, Interesting)
Most PDF files have nothing more than text, vector graphics, and images in "read-only" formats. They don't have fill-in-the-blank fields or load-a-codec-and-play-a-video, or active content.
Web browsers need a "simple PDF" plugin that will activate on PDFs. If the "simple PDF" plugin loads a file with content it can't display, it will display what it can and give the user an opportunity to load the file in a full-fledged PDF plugin or external viewer.
Or as teh hackers will call it (Score:2)
Portable Virus Format, PVF
Security article (Score:2)
Why do all these security articles end up basically saying the same thing?
Patch & update, rinse, repeat.
Everything else in these security/warning articles just show you what happens to the people who never patch anything and open anything & everything.
Re: (Score:3, Interesting)
PDF exploit? Or Adobe Reader exploit? (Score:2, Insightful)
What if you use a PDF reader that's not made by Adobe?
Re:PDF exploit? Or Adobe Reader exploit? (Score:5, Funny)
What if you use a PDF reader that's not made by Adobe?
You download the virus using flash.
Parent
I wonder why? (Score:5, Insightful)
Hmmmm. Maybe this is because they've crammed all kinds of interactive content into a Portable Document Format?
I mean seriously. I thought the idea of PDFs was "this is as simple as a printed copy, and looks the same."
Re: (Score:2)
Wouldn't that describe PostScript better? And even Microsoft's XPS! PDF was pretty much always doing too much IMO... but its what caught on, meh. The features it provides are very very useful. Just not so useful in non-trusted environments.
Re:I wonder why? (Score:4, Informative)
Postscript can contain function calls and as such, is often marked as a potential scripting threat. Google, for example, refuses to send raw eps files as attachments.
A similar principle to Windows MetaFile, which is essentially a list of calls to the Windows graphics library ; several Windows exploits owe their birth to WMF calling unchecked functions in the graphics library.
Note that just because a file format doesn't contain function calls or scripting does not make it secure. A poor implementation of any file reader can be vulnerable to a well crafted file. But active content makes things much easier, because it's much harder to check for security.
Parent
Sumatra PDF Reader (Score:5, Informative)
Use the Sumatra PDF Reader. It is a very lightweight reader. Since it doesn't have all the other useless bloat crap that Adobe's reader has, I'm sure it is a lot less vulnerable. It is also open source, so you don't have to rely on downloading an even more bloated version of Acrobat Reader to fix the exploits.
http://blog.kowalczyk.info/software/sumatrapdf/
I have this installed on all of the PCs here at the office. It has eliminated just about all of the issues i had with the adobe crapware.
Postscript (Score:2)
PDF is essentially a compressed, higher ability Postscript, right? Postscript is a language, and that therefore would be how malware writers exploit it--they exploit bugs in the readers, which are essentially compilers--to compromise a system.
Re:Postscript (Score:5, Informative)
On the contrary, PDF is (originally) a subset of PS plus the ability to embed fonts into the document, apply some overall compression where sensible, and stitch everything together into one carrier.
And while it is true that the past knows about "PS bombs" which e.g. will render your printer useless cause its interpreter is stuck in a loop (after all, PS is a Turing-capable programming language opening all sorts of fun if your idea of fun are stack-oriented languages), the problem with current PDF exploits comes from the fact that this format gets increasingly overloaded.
I can see why one would love to see Javascript and embedding all kinds of multimedia stuff within PDF. Would bring PDF on par with Powerpoint with respect to animations etc. -- which wouldn't be the worst thing for me, cause I love doing slides with PDFtex and beamer, and Adobe of course would like to present their format as a vital alternative to those nasty office formats.
But it also adds complexity. Instead of a simple postscript renderer you end up with a gazillion of helper libraries, bringing in their very own bugs.
Parent
New PDFs in my inbox... (Score:4, Interesting)
Interestingly enough, I have gotten 3 PDFs in the past few days in my corporate email inviting me to various "seminars" on technology subjects. All were very well written and professional looking but for products I have never used and companies I had not heard of. They passed both my email server's scanning and the local virus scan on my company laptop, however since I have very rarely gotten PDFs in the past I am now very suspicious.
Jonah HEX
Re:New PDFs in my inbox... (Score:5, Funny)
I have a link to a white paper on how to tell if a PDF is a security threat. I can share it if you like. PDF format of course.
Parent
Logical Step for Exploits (Score:3, Insightful)
There is now Mac OS, various Linux distros, etc. There is FireFox, Opera, Chrome, etc. There is Open Office, etc. Maybe Adobe needs some good competition in the eyes of the public?
SCAM Research Labs? (Score:4, Funny)
Wait, we're supposed to trust the findings from SCAM Research Labs?
Personally, I'm waiting to get a job at Secure Computing's Over-The-Counter Hardware Research Lab.
Update (Score:5, Interesting)
When I used to use Windows, I found Acrobat to be the most intrusive software ever because of its auto-update. Pretty much every time you try to open a document it's in your face demanding you allow it to update itself and then it often requests a reboot (a reboot? For a PDF viewer??)
This seemed to happen every other week, even if appeased it by letting it do its thing. I suspect this update would be one possible attack vector.
Yet another case in which a "fuck off" key would be a useful addition to the Windows keyboard.
non-FOSS feature proposal (Score:4, Funny)
Although I usually decry any MS Windows-only feature proposal for not supporting Linux, I feel it is appropriate in this case.
Parent
Overuse of PDF (Score:4, Insightful)
The only reason to ever use PDF is if it is NECESSARY for your audience to print the document in question.
Way too often websites have PDFs that are the only alternative for information. If you want to look up a train time for example, once and once only, you almost always have to download a PDF -- why? Sure, give people the choice of doing that if they want to, but there's no reason to slow down the internet for one-off pieces of information.
With concerns about the environment (perceived real or theatrical, regardless), you'd think that firms would stop encouraging frivolous use of paper. With the extortionate cost of printer ink, you'd think that firms would also be cost-conscious.
Uploading a 2 or 3 page document to the web in a PDF format is a criminal waste of resources, it's also an irritation that I don't need. I do not (and will never) work in a corporation. I do not need Office or PDF format -- ever. It's slow, and it's crap to read online.
I can cheerfully live my entire life without it, and I sincerely wish retarded developers and content managers would stop forcing it on me.
Re:Overuse of PDF (Score:4, Insightful)
Given that many of the organizations doing this are government organizations, and they use tax dollars, do you want your tax dollars spent on just redesigning output to be appropriate for HTML? I'll just deal with the (small) annoyance, thanks.
Any format can be exploited. The (over)use of PDF is not the issue here.
Parent
Re: (Score:3, Insightful)
Additionally, plenty of academic papers, presentations, and posters are written with LaTeX. I would rather see people posting such material to the web (in PDF), rather than the alternative of not posting it, or spending time fighting to convert things to HTML and having it look awkward.
Firefox should come with a minimal PDF reader (Score:3, Insightful)
Firefox should ship with some minimal PDF reader instead of Adobe's. There's an incredible amount of junk in Adobe's PDF reader, which adds both vulnerabilities and load time. Has anyone ever used the WebBuy feature of Adobe PDF Reader?
Re:Firefox should come with a minimal PDF reader (Score:4, Informative)
Not disagreeing here but you might like to know there is a common habit of disabling the loading of all the plugins in adobe. I forget how it is best done, but a cheap trick is renaming the plugin directory.
Parent
Re: (Score:3, Funny)
C:\> del /f C:\Program Files\Adobe is probably the command you were thinking of.
If it wasn't then I heartily endorse it as an alternative.
Infected PDF symptoms (Score:4, Funny)
1. Has a tendency to make your browser freeze up
2. Tries to infect some sort of TSR in Windows called Acrord32
3. Will frequently pop up a "checking for updates" dialog
4. Makes the fastest of computers slow to a crawl.
5. a super-jumpy scrolling interface
No wait, those aren't malware symptoms, that's just in Adobe's product. Next week we will discuss the incredible annoyances of the "java runtime environment" daily annoyances & clog-ups in "Add/Remove Programs". Do ANY software vendors know how annoying their software can be at times? Even Apple is guilty of forcing add-on installs you have no choice to get out of.
Exactly The Kind of Analysis We DON'T Need (Score:4, Insightful)
I'm sorry, but in that very brief article linked, I saw absolutely ZERO analysis concerning frequency.
YAY! There's an exploit and toolkit. The existence of which is, in some sense, a useful piece of prior information for establishing the probability that there MIGHT BE an increase in frequency in the future - but it's quite a leap to have a freakin' /. link to a corporate article that uses hyperbole in claiming that there is some State of Nature or State of Knowledge that points to .pdf attacks being "On the rise".
Re:Good news cause PDF's should be shunned (Score:5, Insightful)
No, it's just that for some people PDFs are a hammer and every single printed word on the tubes is a nail.
I have had plenty of times where I was turning in papers electronically or needed to transfer documents between computers where PDF came in quite useful. When I'm turning in a paper electronically, I have no idea what version of Office the professor has. Nor do I even have Office. PDFs are very useful in this case.
Also, it may not be as bloated as you perceive. Acrobot reader is slow as hell. Evince and KPDF, both on Linux, are noticeably faster for me. There are alternatives for Windows as well that are better than the "official" reader.
Parent
Re:Good news cause PDF's should be shunned (Score:5, Interesting)
As a university professor, I actively encourage my students to use PDF files if possible. OS X and Linux come with PDF output, and I'm sure there's a way to do it in Windows without paying Adobe.
I also specifically PROHIBIT MS Office 2007/2008 .docx, .pptx, .xlsx, .xlwx, etc. formats. I'm not paying for an "upgrade" that completely changes the UI and introduces a new format without providing any real benefit to me.
Yes, I accept OpenOffice.org documents (as well as .dvi, .ps, and the formats from iWork)
Parent
Re:Good news cause PDF's should be shunned (Score:5, Informative)
For Windows the best (and free/open source) tool I've found is PDFCreator [pdfforge.org]. It installs a "printer" on your computer that outputs to PDF. Using PDFCreator, you can make a PDF in any application that allows you to print. Using some of the "advanced" features (not really advanced, but slightly more complex than Print->PDF), you can even combine multiple print-outs from different applications into a single PDF.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Informative)
I'll look into it, but the last time I tried the one for OS X it didn't work. It caused major problems with the formatting of the document, amongst other things. (And I have Office 2004 installed on my machine.)
Re:Good news cause PDF's should be shunned (Score:4, Informative)
Parent
Re: (Score:3, Informative)
CutePDF. It shows as a printer. Print to it, and you get a file save dialog asking where to put the PDF.
As a bonus, it uses GPL Ghostscript as it's backend.
Re:Good news cause PDF's should be shunned (Score:5, Informative)
There are alternatives for Windows as well that are better than the "official" reader.
Specifically Sumatra PDF [kowalczyk.info] and Foxit Reader [foxitsoftware.com] are alternative PDF readers for Windows.
They are both orders-of-magnitude faster than Adobe Acrobat. Part of the reason for this speed boost is that they don't implement the hundreds of plug-ins that Acrobat supports. But frankly for >99% of the PDFs you encounter, those additional plug-ins are not required. (In the rare case where a PDF needs one of those features, I guess you can load up Acrobat.)
In addition to a speed advantage, using an alternate PDF reader is probably more secure. Both because it is less well-known (fewer exploits tailored to it), and because they don't implement those hundreds of plug-ins (some of which enable certain kinds of code execution).
Parent