Rogue PDFs Behind 80% of Exploits In Q4 '09 189
CWmike writes "Just hours before Adobe is slated to deliver the latest patches for its popular PDF viewer, ScanSafe announced that by its counting, malicious Adobe Reader documents made up 80% of all exploits at the end of 2009. In the first quarter of 2009, malicious PDF files made up 56% of all exploits tracked by ScanSafe. That figure climbed above 60% in the second quarter, over 70% in the third and finished at 80% in the fourth quarter. Mary Landesman, a ScanSafe senior security researcher, said, 'Attackers are choosing PDFs for a reason. It's not random. They're establishing a preference for Reader exploits.' Exactly why hackers choose Adobe as their prime target is tougher to divine, however. 'Perhaps they are more successful,' she said. 'Or maybe it's because criminal attackers are human, too. We respond when we see a lot of people going after a particular product... We all want to go after that product, too. In the attacker arena, they might be thinking, 'Gee, all these reports of Adobe Reader zero-days, maybe I should get in on them too.'"
Should PDFs be dangerous? (Score:3)
How much danger am I in once javascript is turned off for Adobe's pdf reader?
Re:Should PDFs be dangerous? (Score:5, Informative)
Re: (Score:2)
Disabling browser integration will not disable javascript in Reader... (in fact many of these exploits will operate normally in the stand-alone product).
The only real risk of disabling javascript in Reader/Acrobat is that if you try to use any form that has any logic in it - it will of course not work.
Re: (Score:2)
There's no risk in disabling it. If you download a form that requires it Reader will prompt you and ask if you want to enable JavaScript for that particular PDF. If it's from a trusted source, go ahead and allow it. I've seen plenty of PDFs prompt for Javascript access and when denied seem to have no negative impact. Forms are about the only type I've seen that are impacted.
Re: (Score:2)
What about alternate readers? (Score:3, Informative)
Is the problem with the Adobe Reader program itself or the file format? Do third party PDF readers have the same security issues?
Re: (Score:2, Interesting)
The official PDF spec includes scripting and DRM and all kinds of other crap that 99.99% of pdfs don't use. Many 3rd party readers limit themselves to just displaying documents, so the third party readers are have a much smaller surface area of attack.
Re: (Score:3, Interesting)
Yes Foxit actually has security issues as well.I personally don't think there are as many because Foxit isn't in as much wide use (Foxit isn't bundled with new PC's for instance). [foxitsoftware.com]
The plain and simple fact is that it is hard to make secure software. Couple that with the fact that the PDF format is well over 20 years old (as you can imagine there's a lot of legacy code in the viewer) and you have a recipe for the perfect security nightmare.
The other problem is - once one researcher/hacker finds a big exploit
Me too? NOT (Score:5, Interesting)
The reason for the PDF preference is not "me too". It is, simply, the best current trojan delivery vehicle. I send my CV in PDF format, most of the documents that I deal with are in PDF format.
And I have no way of telling if opening a particular PDF in a particular reader will cause an exploit.
Most users/blockers will not allow EXEs, and can open "ZIP" files to determine if an EXE is enclosed. Microsoft Word has been "hardened". The exploits are going for the weakest part -- output that is in a universal format and is commonly shared. That just happens to have one reader that has most of the market share.
Which means that I will continue to use "Evince" and hope that it won't be targeted soon.
Re:Me too? NOT (Score:5, Funny)
That is also my reason for choosing this fine document format for my CV.
Re:Me too? NOT (Score:5, Insightful)
Adobe reader's web plugin simply opens PDFs without any warning. Nor does it warn if there is javascript running on the PDF. Its a cracker's dream. Most other applications give some kind of warning, especially if there's something scripted in the document. Adobe does none of this. Heck, you can disable Javascript but it will helpfully remind you that its disabled and offer to unblock it if you attempt to open a pdf with javascript. Its really an incredibly terrible way to handle security.
This thing should at least be shipping with js disabled and the only way to enable it is by going into Preferences. The web plugin should be retired and just force the pdf to open in the full reader. One can dream, right?
Re:Me too? NOT (Score:4, Insightful)
Worse yet, instead of warning you that a PDF is about to execute JavaScript code, Adobe Reader actively and repeatedly harasses you if you turn off JavaScript, telling you that it won't work properly. This, even if the PDF you are viewing contains no JavaScript whatsoever.
Instead of bothering you when you do something dangerous, it bothers and encourages you to let it behave insecurely. Adobe has become the new Microsoft, with respect to hindering user security.
-- Len
Re:Me too? NOT (Score:4, Informative)
Hrm tested this in 9 - it only complains with Javascript disabled that the PDF contains some elements that might not be displayed properly because of the preference, and ONLY IF you open a PDF with Javascript in it.
Static PDF files it does not display any warning if JS is off.
Re: (Score:2)
That's even worse; user opens the malware PDF which contains JS, Adobe reader moans that JS is diabled and the document is screwed without it, user enables JS. Very poor.
Re: (Score:2)
But EVERY document I've seen HAS javascript. I don't know what that javascript is, but I assume it's stuck in there automatically by Adobe Acrobat (not reader) or something because it's ALWAYS there. (Some 3rd party PDF creators might not put it in. I haven't tested.)
Re: (Score:2)
Interestingly enough - in my days at Adobe doing Tier 3 support - the exploit PDF's I'd get from various sources internally were hard to move around the network because virus scanners would delete or clean them up.
I found this rather surprising many times because these scanners would do this to files that were zero day exploits and files that weren't yet disclosed to the public.
Also if your installing reader to your enterprise you can disable browser integration, javascript and a myriad of other features ou
There are several steps to lock down Adobe Reader (Score:2)
This US-CERT vulnerability note has details for steps for making Adobe Reader safe to use:
http://www.kb.cert.org/vuls/id/508357 [cert.org]
As you mentioned, disabling JavaScript helps. But you can also prevent PDFs from opening automatically with the plug-in, and also prevent them from opening automatically with the stand-alone reader. There are some other mitigations there as well.
Of course, this all requires manual configuration. There is no hope for the average home user.
Re: (Score:2)
>You can actually do this, in the Firefox prefs, under the Applications tab. (
Oh, I do. Id prefer to see it as the default for the application. Joe Sixpack isnt doing this.
Re: (Score:2)
You can do it that way, but it's better to go into Acrobat settings under "internet" and tell it not to open PDFs in the browser. Then disable the plugin. ;)
Re:Me too? NOT (Score:5, Insightful)
Most users/blockers will not allow EXEs, and can open "ZIP" files to determine if an EXE is enclosed.
And IMO this is exactly why everyone should be wary of putting scripting languages into documents. We have a well-established convention of distinguishing "documents" from "applications"; "documents" are passive collections of information, whereas "applications" do stuff.
We block applications and scripts because they do stuff and we can't easily know what it is that they do, but we don't block documents because, in theory, they can't do anything. Loading a document in its proper viewer application shouldn't do anything that the viewer wasn't explicitly designed to do. If you throw scripting applications and macros into the documents, then suddenly the "documents" do stuff too. This, in my opinion, is bad.
Re: (Score:2)
If you write a script for Word to do something that would normally take a thousand mouse clicks to do - why is that bad?
If you have a browser form that has a script to submit to a server and valid the form fields while doing so - why is that bad?
Re: (Score:2)
If you write a script for Word to do something that would normally take a thousand mouse clicks to do - why is that bad?
It's not bad to run a useful and benign macro that you wrote youself.
What's bad is that in a botnet's hands VBA has access to the entire computer, and not just to the document or its' folder. (yes, I know that there have been some improvements in that regard, but that depends more on the OS & application settings than on inherent VBA limitations)
Re: (Score:3, Insightful)
Just to be clear: I have no problem with macros. I have no problem with scripts. If you want to write a macro in Word that will make your workflow easier and faster, I think that's great. I think it's great that Microsoft had the forethought to include support for scripting in MS Office.
What I object to is embedding macros in Word documents. I think this is dangerous design. If you want to write your own macro and store it on your computer, then you shouldn't need to embed it in the document itself.
Re: (Score:2)
Believing any document format to be "inert" is a fallacy. All data must be somehow interpreted by the computer in order to be useful -- a pile of bits on a hard drive is not useful to any human. Whether there are exploitable flaws in the software which interprets the data is only loosely related to the data itself. There have been exploitable bugs in everything from PDF readers to MIME decoders to MP3 players. Obviously, deliberately embedding a scripting language into a document format does not help matter
Re: (Score:2)
...but don't confuse yourself into believing that some document formats are inherently safer than others. The vulnerability is fundamentally in the software, not the document.
I'm not the one confusing things. First, of course it's not the format itself, but what's interpreting the file. Text files are pretty harmless all by themselves, but I don't go sending arbitrary text files to be interpreted by bash. Likewise, it's not the inclusion of javascript in PDFs that's a problem, but rather the fact that PDF viewers interpret that javascript creates a great opportunity for malicious code.
And yes, theoretically, if a viewer has exploitable flaws, then you can exploit them. I'm
Re: (Score:2)
All data must be somehow interpreted by the computer in order to be useful
It's not a question of code being run, it's a question of attack surface. A properly-designed document format that does few things can be interpreted by simpler code, and thus is less likely to be exploitable for attacks. PDFs should be proof of this rule by now, given how much of a monstrosity both the spec and Adobe reader are at this point. See also javascript vulnerabilities in browsers.
Re: (Score:2)
You are making the "keep the code separate from the data!" argument. You forget the one place in every application where code and data intermingle: the stack.
There is no getting around the stack. It is itself data about what code to exec
Re: (Score:3, Insightful)
Why does a document viewer need to run code (javascript of whatever)
99.99% of people use it to display and/or print static documents .... it's only that Adobe keep extending it to do thing outside this ....
The core view a PDF is fairly bug free and exploit free it is the extensions that are buggy and vunerable ....
Re: (Score:2)
Flash Paper [wikipedia.org]?
Wider target audience (Score:3, Insightful)
Attacking Adobe Reader means that people who use Firefox are also at risk. For a long while, the popular security paradigm on Windows was that if you used IE you were at risk, but if you kept up with Windows Update and used only Firefox to browse the web you were pretty much safe from the majority of the exploits in the wild. Now that malicious PDFs are out there in force, users of Firefox are vulnerable once again.
This will kill pdf (Score:2, Funny)
Two simple safeguards that help (Score:4, Informative)
a) Configure your web browser so it asks you to download pdf files instead of opening them automatically.
b) Use an alternative PDF reader/viewer.
Why? (Score:2)
80% of exploit code or incidents? (Score:2, Insightful)
But does it run in Linux? (Score:4, Funny)
Re: (Score:3, Interesting)
Since Mac OS X has built-in support to read and write PDFs, who installs Adobe Reader on a Mac?!
Re: (Score:2)
As far as I've ever seen, only Windows converts who don't know any better.
Re: (Score:2)
Re: (Score:2)
But I think it is more a personality issue with him. Basically you can tell him he shouldn't do something for any number of reasons. He will spend days trying to figure out why he has to do something exactly the way you asked him not to it.
I just cringed when someone told him he couldn't use Adobe Reader on his MacBook. Sure enough a week later it was installed.
Adobe is a security nightmare (Score:5, Interesting)
I scan with Secunia's (a Danish computer security company) freeware tool [secunia.com] to check if I have insecure applications.
3 times out of 4, when something has a category 4 or category 5 exploit (e.x. click2own), it's Adobe Flash Player, Shockwave, AIR, Reader/Acrobat, etc.
It's also interesting because it tells you if your browsers are insecure (due to plugins or the browser itself). Both IE8 and Chrome are insecure in current versions with all patches.
It was pretty eye opening for me, because I thought that I kept secure, but I had 20 insecure applications when I first got the scanner. I'm always skeptical about getting stuff for free, but I imagine that Secunia uses the data to improve the accuracy of their business software.
To return to the story topic... when possible, use Adobe alternatives (e.x. Sumatra instead of Adobe Reader) and check your flash player and shockwave player versions at least once a week.
Firefox Users can use Mozilla's plugin check [mozilla.com].
One more thing in my diatribe...recent versions of the Shockwave Player don't update correctly. I installed the latest version to fix a couple critical vulnerabilities only to find out that it wouldn't reomve the vulnerable files from my system directory. I had to download the Shockwave uninstaller, reboot my PC, reinstall shockwave, and reboot again. I felt like I was back on Windows 9x again.
Re: (Score:3, Informative)
I opened the Advanced interface of Secunia PSI, the program overview says:
'Cannot display graph, as Adobe Flash Player does not appear to be installed in Internet Explorer on your computer...' then provides a link to install it.
I feel betrayed.
Re: (Score:2)
The more you know, I suppose.
The tool works very well though- it warns me about having insecure versions of GTK, for instance.
Re: (Score:2)
That irritated the hell out me too! Especially since flash is a pain in the ass to update. You may install a new one, but old cruft is left behind that can be difficult to remove sometimes. Other than the flash issue, Secunia PSI is excellent.
Re: (Score:2)
It isn't "I want some of that too" (Score:4, Interesting)
In the attacker arena, they might be thinking, 'Gee, all these reports of Adobe Reader zero-days, maybe I should get in on them too.
It isn't that. It is the fact that some of the holes took so long to have patches released, so people who don't read techie news (so didn't know to turn Javascript off in the case of those holes in that area) we vulnerable for some time even once the flaw was "publicly" known. This gave crackers time to throw together a "me too!" exploit for the same bug, and encouraged them to keep looking at the platform (if a hole, once found, stays open for some time then the effort is more worth it than looking for a hole on a platform where security patches are released in a more timely fashion).
The other advantage of attacking Adobe's PDF reader is, as with Flash and other cross-browser plug-ins, one of target audience size. A successful attack may affect users of multiple browsers rather than, for example, just those who run a particular version of IE.
Not just Adobe (Score:4, Interesting)
I just got a trojan yesterday through a PDF, while using Foxit and running Windows 7 x64 in Firefox. I didn't think anything of allowing a website to execute a PDF file (I was not aware at the time that you could execute code through a PDF).
The trojan downloaded quite a bit of malware onto my system that I spent last night cleaning from the registry. This is the first time I've gotten malware on my computer in years.
Re: (Score:2)
Can anyone else confirm that Foxit has known security problems?
Re: (Score:2)
Can anyone else confirm that Foxit has known security problems?
Sadly, yes [coresecurity.com]. Foxit isn't happy with just doing basic rendering on PDF's, but wants to be a more completely alternative to Adobe's Reader. This includes things like running PDF's scripting, and makes it harder to implement securely.
I'm not saying a secure, full-featured PDF reader can't be made, so much as that you're a lot safer using a program that only does the basic rendering. Foxit doesn't fit the bill. It's also closed source >.>
Re: (Score:2)
Re: (Score:2)
running Windows 7 x64 in Firefox
Wow, that's quite impressive! What OS was Firefox running on? Bonus points if it was Linux or Mac.
Re: (Score:2)
Has Firefox been ported to Emacs yet?
No, but Emacs will read PDFs now (I'm not kidding)
Hard month for Adobe. (Score:2)
Re: (Score:2, Informative)
Re: (Score:2)
Because of JavaScript support in Adobe Reader! (Score:4, Informative)
I have noticed that while web browsing and even when using the currently latest Mozilla Firefox 3.5.7 or 3.6 with Ad-Block Plus and PDF Download add-ons installed I still would get hit with a web page that would automatically push a Adobe Reader PDF file to me and I would have it open automatically. That PDF would be just a page full of random words but when inspected in Adobe Acrobat in depth when you go into the Advanced \ Document Processing \ Edit All JavaScript... menu you immediately see a script inside the PDF that is launched upon opening that PDF. When I analyzed the script I saw calls strange calls to the execution functions and methods along with calls to write out encoded data from an array holding hexadecimal values to files.
With the known exploits in Adobe Reader 9.0 versions and earlier it was easy for me to see why this product was used as a popular attack vector in the last few months for viruses to spread on the Internet.
Luckily, I use my computer as an ordinary user and use Run As with User Account Control requesting a password for any administrative work and program installation I avoided being infected with these Trojan horse PDFs.
Some of you might recommend using the Mozilla No Script add-in to block all scripts but the reality is that there is so much JavaScript code out there on the web that turning scripting off makes many web sites unusable since they've all be designed with this reliance on scripting for navigation.
Re: (Score:2, Informative)
Uncheck "Preferences->Internet->Display in browser" and Acrobat will prompt you to save those files rather than automatically loading them (this will probably also render your downloading extension redundant).
Re: (Score:2)
If I wanted to disable Javascript entirely, I'd do it in the browser preferences or options or whatever that is. The advantage of NoScript is that it does it selectively. Most sites I go to I've just activated pe
Javascript in PDFs? How dumb is Adobe? (Score:3, Insightful)
As another poster pointed out: including scripting capabilities in "static" documents is just dumb. We've already been through this a few years ago, with people sending around Microsoft Office documents.
Microsoft "fixed" this, in the sense that Office now warns you if a document contains scripting. Better, of course, is that many people have learned not to send or accept such documents in the first place. This was part of what made PDFs popular: a format to send documents that (a) cannot easily be changed and (b) is not a security risk. Millions of business documents are sent as PDFs just for these reasons.
How stupid must Adobe be, to open themselves to this kind of attack. There should be no scripting in PDF documents. Alternatively - second best - scriptiing should be disabled by default, unless the user specifically authorizes it (as with Microsoft Office documents).
Bad Adobe, no donut.
Ubiquity... (Score:2)
They target Adobe's PDF reader because it is extremely widespread, most users don't even realise PDF is a standard and that other readers exist... They think it's a proprietary format only supported by a single program.
As a consequence, virtually every potential victim will be running exactly the same code, or a small subset of possible versions making them a very easy target.
Also Adobe's software hasn't been attacked much before, and therefore is likely to have many more undiscovered bugs.
This is also the
Re: (Score:2)
And it's another Windows problem (Score:2)
Acrobat is cross-platform, but this only affects Windows users in practice - because Mac users use Preview, and Unix users use something Xpdf/GhostScript-derived.
Solution: FoxitPro. Now.
Sumatra PDF - sort of OK, maybe. (Score:3, Informative)
I've been using Sumatra PDF for the last year. It's rather clunky and uses too much memory on long documents, but it's adequate for most viewing.
Its renderer is rather slow, though. And when you zoom, it renders the document first zoomed in X, then, seconds later, in Y as well. That's just stupid.
Missing the broad side of the barn (Score:2)
Exactly why hackers choose Adobe as their prime target is tougher to divine, however.
Adobe Reader and Adobe Flash have as close to a 100% share of the desktop as makes no difference. The geek's dislike of these programs has had no more effect on their use than the phases of the moon or the rising and setting of the sun.
The Complete National Geographic [amazon.com] on DVD was a runaway software best-seller during the Christmas shopping season. Adobe AIR powered, of course
The Flash 10 Beta Player [for Windows] delivers
Re:How about (Score:5, Informative)
Or more likely (Score:5, Insightful)
How about "Adobe Reader is the only relevant PDF reader on the market"? Is it really that hard to understand?
Or how about:
"Adobe Reader is shit. Zero day exploits are like shooting ducks in a barrel." Or maybe "It's the platform, and Adobe is just the vector de jour. IE was last months, Office the month before that, and Flash (or something equally widespread, complex, superfulous and buggh) is next month's ..."
Microsoft Windows users are known as the road-kill of the Information Superhighway for a reason, and Adobe can only take some small credit for their contribution to that.
Re: (Score:2, Insightful)
Ah, the old "Windows is insecure" rant.
Drive-by installs via exploit vulnerability can happen on any OS. Only thing that might currently mitigate that is SELinux, but it's pain in the ass generally and no casual user would put up with it. Most of the vulnerabilities now a day are in 3rd party softwares like Flash or PDF Reader. They are exactly as vulnerable on any system.
It pretty much all happens on Windows currently only because its so popular (and the users are generally dumber than those geeks running
Re: (Score:2, Insightful)
It pretty much all happens on Windows currently only because its so popular (and the users are generally dumber than those geeks running for example Linux on desktop).
Apache is the most popular web server and it is open source. Shouldn't it have more security problems as IIS? Where is the Code Red for Apache, that infected over 250.000 servers?
Windows is targeted because of the poor security choices from Microsoft. To name a few, ()patch Tuesday, ()cannot delete opened file, ()No distinction between admin
Re: (Score:2, Informative)
Whoa, you're bringing up ten year old worms to the table. Do you even understand how many old worms there has been with Linux/UNIX in all of its history, most of them not even requiring a web server?
Any of those things you list as "poor security choices from Microsoft" aren't even such.
patch Tuesday
Patch Tuesday streamlines the update process in large companies. It would be really bad solution from MS to force the update randomly, possibly breaking things. Linux doesn't even have automated update at all - you have to ru
Re: (Score:3, Informative)
You seem to confuse "offer" with "force". Why not offer a patch when it is ready and let the companies decide themselves when and how often to patch? Just like every other OS vendor on the face of the planet?
Re: (Score:2)
Re: (Score:2)
This was certainly an MS issue, the fact that the number of apache INSTALLATIONS is considerably smaller. The default IIS install having crappy permissions didn't help. The fact that most of the infections where on client PCs and servers that never should have had IIS installed plays a part in it. The fact that admins run Apache and are far more likely to keep it up to date than gradma who never installs updates.
Either way, it is all MSes fault, no doubt about it, Apache h
Re: (Score:2)
Re: (Score:2)
Bla bla bla victim of popularity. Yes you can expect your popular product to be attacked more because of its popularity. But that doesn't excuse the vendor of fixing it. The same popularity should (if your business model isn't full of fail) enable you to audit your code and respond to vulnerabilities faster. The number of attacks are up but so is your research and development funding.
The problem is that even though a vendor knows the attacks are coming and often has the resources to head it off, very o
Re: (Score:2)
Re: (Score:2, Insightful)
No, it's because very few linux users are computer illiterate, while a great many windows users are. Targeting windows users (and with attacks like this, it is the users that make the attack possible, not the platform) is going for the low hanging fruit.
Re: (Score:2)
Re: (Score:2)
Microsoft Windows users are known as the road-kill of the Information Superhighway for a reason....
Seriously though, no one says that. No one even says "Information Superhighway".
Re: (Score:2)
You know the old Italian proverb: "Si non è vero è ben trovato"
And it was funny.
Re: (Score:2)
Re: (Score:2)
'Probably 3/4 of our customers are running Acrobat Reader 7 or earlier because no one wants to go to the trouble of upgrading reader software, and Adobe's filthy habit of forcing customers to install garbage that they vehemently don't want (like their stinking download manager) doesn't help matters.'
The thing I especially love about this is how Adobe have now stopped providing security updates for Acrobat 7 (the full version you pay money for, not just the reader). Acrobat 7 was a current product until just
Re: (Score:2)
Uh, no one needs Adobe Reader on any platform. There are plenty of alternatives and Foxit is probably the best one (and isn't as bloat as Adobe's)
Re: (Score:2)
The difference is that windows is the only platform which doesn't come with a PDF reader by default...
And to make matters worse, many users aren't aware that alternative pdf readers exist at all, how many mac users do you think install adobe's viewer because they don't realise preview.app can handle PDF files very well. Users have the mindset that file formats are proprietary and belong to specific programs.
Re: (Score:2)
Users have the mindset that file formats are proprietary and belong to specific programs.
How about:
Users have the mindset that their documents are somehow stored "inside" the program. Consider a conversation I had recently about a customer that needed a newer office suite, but didn't like the Office 2K7 ribbon:
Me: Ok...so we'll uninstall Office 97, and install OpenOffice instead. It's free.
Them: But all my documents are in Word.
Me: Yes. OpenOffice will handle them just fine.
Them: But all my documents are stored in Word. If you take Word off my computer, how will I get my documents?
Me: Just
Re: (Score:2)
So do it the other way.
Install OpenOffice demonstrate the files aren't necessarily in Word and uninstall OO.org
Re: (Score:2)
A disturbing number of mac users actually install adobe reader and let it set itself as their default pdf viewer, despite that OSX already comes with a much better PDF viewer, people are conditioned to think that PDF files require adobe acrobat.
Re: (Score:2)
Re: (Score:2)
I'm sorry, but it's totally untrue! When your browser locks up, it's probably Adobe Flash which is to bla... oh wait, never mind.
Re: (Score:2)
or use foxit reader ?
Re: (Score:2)
Why is JavaScript so easily exploitable? It's probably the APIs available to the JavaScript, and not the language (or interpreter) itself that's exploitable.
Re: (Score:2)
Why is JavaScript so easily exploitable?
Probably because it's a weakly typed language and therefore programmers are sloppy when they use it.
Re: (Score:2)
It's a very inconsistent language, full of convolution and idiosyncrasies due to it being a hack from the very beginning.
Ahhh I see the problem -- you're confusing JavaScript with PHP!
Re: (Score:3, Insightful)
I agree with this analysis of Javascript. It was never designed with security in mind, much like the original versions of Windows.
That said, it's sort of silly anyway. How do these PDFs arrive? By email or downloaded from the internet. And what do we NOT do with email attachments we don't recognise? We DON'T open them. What do we do with something we downloaded from the internet? Scan it for viruses.
We all know the defense. It's getting people to use their brains instead of happily clicking on everyt
Re: (Score:2)
And what do we NOT do with email attachments we don't recognise? We DON'T open them. What do we do with something we downloaded from the internet? Scan it for viruses.
It's possible that .PDF exploits are so successful because the average user doesn't think of them as an executable file. Under windows, the idea of "don't open .exe attachments!" has been drummed into the heads of all but the noobest of noobs (grandparents, AOL'ers etc.), but how many "experts" pass every web URL to a virus scanner before brow
Re: (Score:2, Interesting)
Re:Why does anyone use Adobe reader anymore? (Score:4, Insightful)
Re:Why does anyone use Adobe reader anymore? (Score:4, Interesting)
You cannot use Foxit on Livecycle forms and other kinds of interactive forms. Foxit doesn't support online commenting and reviewing, Foxit doesn't support 3d annotations (Reader even supports PMI extensions). Yeah Reader is big, but it has a ton of customer requirements.
Foxit does have security advisories - google it, and its not even a major target.
Re:Why does anyone use Adobe reader anymore? (Score:4, Insightful)
Re: (Score:2)
Says you, but if you had people handing you cash to do this you'd glad get your company's engineering department to make it.
I mean - how do you personally justify HTML with Javascript? Its the same concept.
Re: (Score:2, Interesting)
I'm wondering the same thing myself. I use Sumatra instead which is a far more stripped down reader. My instincts tell me that I'm safer because it doesn't have all of the integration (java etc) but I'd love to see some comparisons.
Re: (Score:2)
You don't need any plugins for that (no Flash etc) as each page is simply converted to an image server side. I would think that this is secure.
In any case i always disable all file format plugins in FireFox. It actually happened a few days ago that i was suddenly asked to save a PDF file even though i didn't click on any link, on examining adblock i found a hidden iframe that apparently tried to