Rogue PDFs account for 80% of all exploits, says researcher

Adobe's Reader wins 2009 hacker honors by a landslide, says ScanSafe

Just hours before Adobe is slated to deliver the latest patches for its popular PDF viewer, a security firm announced that by its counting, malicious Reader documents made up 80% of all exploits at the end of 2009.

According to ScanSafe of San Bruno, Calif., vulnerabilities in Adobe's Reader and Acrobat applications were the most frequently targeted of any software during 2009, with hackers' PDF exploits growing throughout the year.

In the first quarter of 2009, malicious PDF files made up 56% of all exploits tracked by ScanSafe. That figure climbed above 60% in the second quarter, over 70% in the third and finished at 80% in the fourth quarter.

"PDF exploits are usually the first ones attempted by attackers," said Mary Landesman, a ScanSafe senior security researcher, referring to the multi-exploit hammering that hackers typically give visitors to malicious Web sites. "Attackers are choosing PDFs for a reason. It's not random. They're establishing a preference for Reader exploits."

Landesman, the author of ScanSafe's just-published annual threat report , said that attackers' preferences for PDF exploits were clearly demonstrated by the data. Exactly why hackers choose Adobe as their prime target is tougher to divine, however.

"Perhaps they are more successful," she said. "Or maybe it's because criminal attackers are human, too. We respond when we see a lot of people going after a particular product.... We all want to go after that product, too. In the attacker arena, they might be thinking, 'Gee, all these reports of Adobe Reader zero-days, maybe I should get in on them too.'"

She also called out the popularity of Reader as a big reason why hackers have pinned a bull's-eye on Adobe. "There's the ubiquitous factor," Landesman said. "PDF use is huge."

Contributing to Adobe's problem is a major increase in vulnerabilities. Landesman's searches of the Common Vulnerabilities and Exposures (CVE) database showed a rapid climb in reported bugs harbored within Adobe's products. In 2009, 107 Abode vulnerabilities were logged into CVE, nearly double the 58 added in 2008 and almost triple the 35 reported in 2006. "There's obviously a lot of activity [by researchers] trying to flush out vulnerabilities from Adobe's software," Landesman said.

"All of these things kind of converge," she added. "I'm not trying to bash Adobe.... Attackers are like electricity, they always follow the path of least resistance. For them, it's 'Tag, you're it,' and Adobe is the one now."

Just as Adobe has done many times itself, Landesman recommended that users disable JavasScript in Reader and Acrobat and steer clear of the Reader browser plug-in.

Later today, Adobe plans to patch several critical vulnerabilities in Reader and Acrobat for Windows, Mac and Linux .

As Landesman intimated, Adobe struggled to keep up with hackers last year. In 2009, Adobe patched four PDF vulnerabilities only after they had already been exploited; 2010 hasn't started out much better, with one PDF zero-day already on the books.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags pdf

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?