Adobe puts PDF reader in quarantine

This isolation of the Adobe's client software for viewing PDF documents will be available for the Windows version, running on XP, Vista and 7

Adobe provides its beleaguered PDF reader with sandbox technology to thwart exploits. "This is coming out in the next major release", reveals Brad Arkin, head of security at Adobe, to Webwereld.

The software maker has developed collaboration with Microsoft and Google. Specifically the development teams of Office 2010 and Chrome. This office suite and browser makes any isolation techniques also known as sandboxing, from Arkin explains. "We have the entire implementation or myself. For Adobe called the Protected Mode."

Intermediate layer

The sandboxing of Adobe Reader is turned on by default. It should stop almost all current exploits. "For example, it refuses write access to the registry, and writes in the file system of the computer." However if a write permission is needed, as might be the case for legitimate PDF documents, this is done through a new intermediate layer. "The sandbox process must request permission from the broker process. This is a small, newly created piece of software."Arkin is not worried that the new broker might be a new weakness. It will probably be a new attack target. But it will be a line of defence that malware creators have to conquer after they've successfully abused a hole in Adobe's PDF software. The latter has been done before, Arkin notes dryly. The PDF reader from Adobe has since last year been increasingly under attack from malware authors, who find and exploit holes in it.

Not a silver bullet

Adobe does not claim that this puts a stop to all security problems for it's PDF-reader. "It is exciting new technology, but not a silver bullet." This protection does not work against social engineering or some phishing attacks. It does help against malicious PDF files."

Tests in Adobe's security labs have proven the effectiveness of the sandboxing. But those exploits are aimed at the currect situation, the current Adobe Reader. "The malware authors will respond," Arkin acknowledges.Yet he is optimistic: "This will remain an effective protection. The bad guys now have to do a two-stage attack. First they have to hijack the PDF Reader process, and then get through the broker-process." That new intermediate layer functions based on policies: what application component may under which circumstances write where outside of the Reader software, for example in the Windows registry.

For Windows

This isolation of the Adobe's client software for viewing PDF documents will be available for the Windows version, running on XP, Vista and 7. It will be delivered in the next "major release" of Reader, but Arkin can not yet say when that will be. "To clarify: Adobe Reader 8 and 9 will not have the Protected Mode."He stressed that the development of that protection was quite a job: "Adobe Reader is a large, complex application. This was not a matter of 'just sandbox it'." One of the stumbling blocks was the printing functionality, for an existing PDF document and for transforming another document to a PDF by using a virtual PDF-printer. Printing requires a lot interaction, including writing activities, wit the operating system.

'No user impact'

"Adobe Reader will be running in a sandbox, which will include all activities for the viewing of a document, including streams, embedded videos and JavaScript." The isolation covers the application as a whole, but is not applied per PDF document. According to Arkinm the average user will not notice the new security technology. "There is no impact on performance.""There are some cases where there is an impact. For example, users on Windows XP who use 'assisted reading'." The functioning of applications that read text for blind people is not compatible with the upcoming isolation of the PDF reader. "The user will hear a message and instructions how to disable Protected Mode."

Next steps

Initially, the Protected Mode in Adobe Reader only stops write access. That protection will be extended by a smaller update following the next major version containing the sandboxing. That so-called .1 release will deliver sandboxing for read operations.Adobe currently has no plans to implement the sandbox approach into it's professional PDF product Acrobat. That choice is also motivated by the large number of users worldwide of the free PDF-reading application. "But the new PDF Reader can run besides Acrobat and we change the default action for reading PDF files. Reader or its browser plug-in, opens PDFs, not Acrobat."Arkin says that Acrobat is not necessarily excluded, but that Adobe will first wait how the new security measure works out. Basically, it will watch for the response of malware creators. "Maybe we will bring the Protected Mode next to Adobe Reader on Unix, or Mac OS X."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags applicationsAdobe Systemssecuritysoftwarepdf bug

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jasper Bakker

WebWereld Netherlands
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?