Windows needs a built-in PDF viewer, argues researcher

Windows needs a built-in PDF viewer, argues researcher

Simple viewer from MIcrosoft would protect users from some Adobe Reader exploits

Microsoft should add a basic PDF viewer to Windows to help protect users from the spike in attacks exploiting bugs in Adobe's Reader, a security researcher said Friday.

"Apple does this with its Preview [application], and Microsoft should, too," said Sean Sullivan, a security advisor with Finnish antivirus vendor F-Secure's North American operation. "I just want to view and read PDFs. I don't want to listen to them or watch them or launch executables from them or run JavaScript," Sullivan added, referring to several advanced features that Abobe's own PDF viewer, the for-free Reader, supports.

Some of those features, including Reader's support of JavaScript and the PDF specification's support for the /Launch function, have been exploited by attackers in increasing numbers since 2008. According to tallies by antivirus vendor McAfee, PDF exploits were up more than eight times in 2009 compared to the year before, a trend that has continued into 2010.

And the /Launch function, which allows PDF documents to run embedded executable files, is currently being exploited by attackers in a widespread malicious message campaign that tries to trick users into opening a rigged PDF.

Sullivan spelled out his case in more detail in a post to the F-Secure security blog on Thursday. "Your customers are tired of the exploits and the complications that so many of today's PDF readers include," said Sullivan in a "Dear Microsoft" missive.

"They should write a really simplified viewer, one that just previews PDF," Sullivan added Friday in a telephone interview. "They don't even need to build it into the operating system. They can make it an optional download like they did the 'Save As PDF' add-in for Office."

Although Microsoft intended to add support for saving documents in the PDF file format to Office 2007, it was forced to backtrack when Adobe balked. Instead, Microsoft built a "Save as PDF" add-on that it made available free of charge. After Adobe submitted the PDF/A specification to the ISO (International Organization for Standardization) in 2008, Microsoft added "Save As PDF" support to its suite with the release of Office 2007 Service Pack 2 (SP2) a year ago. The same feature is available in Office 2010.

Office cannot open PDF documents without third-party software or add-ons, however. Windows 7 's and Windows Vista's preview feature also won't display PDFs. Instead, Microsoft has promoted, with little success, a substitute for PDF dubbed XPS (XML Paper Specification); an XPS viewer is bundled with Windows 7, for example.

"The PDF specification has been completely royalty-free since 2006," said Sullivan, noting that Microsoft would not have to pay Adobe if it did craft a viewer of its own. "There's no reason why it can't create a native PDF viewer. It could even let users toggle it on and off, if it [were] worried about antitrust [issues]."

Several times, Sullivan compared his vision of a Windows PDF viewer to Preview, the application that Apple includes with Mac OS X. But Preview is not bug free: In March, researcher Charlie Miller said he'd found more than 60 PDF files on the Web that could be used to crash and likely exploit Preview .

Even so, Sullivan argued that Microsoft, or failing that, Adobe itself, should develop a stripped-down PDF viewer that omitted the functionality and features hackers have exploited. "I wish Adobe would create two different versions of Reader, one maybe 'Reader Lite' that's really just a viewer," he said.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld . Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is .

Read more about security in Computerworld's Security Knowledge Center.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.



The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments