Menu
Adobe bolsters security in Reader, Acrobat XI with added features

Adobe bolsters security in Reader, Acrobat XI with added features

Adobe Reader and Acrobat XI have a better sandbox and new security features that can block more attacks, Adobe says

The recently launched Adobe Reader and Adobe Acrobat XI come with new security features and an improved sandbox that will make the products harder to attack and exploit, according to Adobe.

The sandboxing feature known as the Protected Mode that was first introduced in Adobe Reader X proved successful at mitigating traditional PDF exploits. The technology works by isolating certain Adobe Reader operations in a strictly controlled environment and makes it very hard for attackers to write and execute malicious code on a system after exploiting a vulnerability in the product.

"Since we added sandbox protection to Adobe Reader and Acrobat, we have not seen any exploits in the wild that break out of the Adobe Reader and Acrobat X sandbox," Priyank Choudhury, a security researcher within Adobe's Secure Software Engineering Team, said Wednesday in a blog post.

However, this doesn't mean that the Adobe Reader X sandbox can prevent all types of attacks. For example, the sandbox was primarily designed to restrict write operations, not read ones, which means that potential attackers can steal sensitive information from a system after exploiting an Adobe Reader X vulnerability.

That's no longer a problem in Adobe Reader XI, Choudhury said. "In Adobe Reader XI, we have added data theft prevention capabilities by extending the sandbox to restrict read-only activities to help protect against attackers seeking to read sensitive information on the user's computer."

"I've warned before that Adobe Reader X's sandbox is a write sandbox, e.g. that reading is still fully permitted and thus still allows stealing of information," Didier Stevens, a security researcher well known for his PDF security work, said Thursday via email. "I tested that."

Stevens assumes that the new sandbox model in Adobe Reader XI prohibits the reading of files and registry keys, but hasn't had a chance to test it yet. If that's the case, it would be an important improvement, he said.

The new version of Adobe Reader also comes with a Protected View mode that further strengthens the sandbox by creating a separate window station -- a separate securable clipboard and desktop -- for the PDF viewing process. This function is designed to block so-called screen-scraping attacks in which one application reads data from the display output of a different program running on the same desktop.

Adobe Acrobat already had a Protected View mode that has been enhanced in the new version. "Protected View behaves identically for Adobe Reader and Acrobat, whether viewing PDF files in the standalone product or in the browser," Choudhury said.

The support for Address Space Layout Randomization (ASLR), a memory-based anti-exploitation technology, has also been improved in the new Adobe Reader and Acrobat versions.

ASLR can be tricky to implement in a program, because all of its executable files and dynamic link libraries (DLLs) need to support it for the protection to be fully effective.

"In Adobe Reader and Acrobat XI, we have enabled support for Force ASLR on Windows 7 and Windows 8," Choudhury said. "Force ASLR improves the effectiveness of existing ASLR implementations by ensuring that all DLLs loaded by Adobe Reader or Acrobat XI, including legacy DLLs without ASLR enabled, are randomized."

In addition, Adobe Reader and Acrobat XI benefit from a new PDF Whitelisting Framework that will allow system administrators, especially in enterprise environments, to enable specific functionality like JavaScript only for select PDF files, sites or hosts.

Many security researchers recommend disabling JavaScript support in Adobe Reader and Acrobat because most PDF exploits require JavaScript to work. However, this functionality can also have legitimate purposes, so disabling it for everyone in an enterprise environment might be impractical.

The new Adobe Reader and Acrobat XI also have support for content digital signatures that use Elliptic Curve Cryptography (ECC). "Users can now embed long-term validation information automatically when using certificate signatures and use certificate signatures that support elliptic curve cryptography (ECC)-based credentials," Choudhury said.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments