Facing criticism, Adobe rethinks PDF security

Promises more secure code, faster patching and regular updates for Reader

Blasted three months ago for being slow to fix a zero-day vulnerability in its popular PDF viewer, Adobe today promised it will root out bugs in older code, speed up the patching process and release regular security updates for Adobe Reader and Acrobat.

The flak Adobe caught in February, when it disclosed a critical vulnerability, admitted the bug was being used by hackers, but then took weeks to patch the problem, is what prompted Adobe to review its security practices, acknowledged Brad Arkin, Adobe's director for product security and privacy.

"At first, this was just another of our normal security incidents," said Arkin. "But it ended up expanding to [make] changes in our security practices with Reader and Acrobat."

The project, which kicked off in February, has three parts, said Arkin, starting with a look at the legacy code in Reader and Acrobat that he characterized as "at-risk areas."

Currently, Adobe develops new code under what it calls its Secure Product Lifecycle (SPCL), an approach similar to Microsoft's much-better-known Software Development Lifecycle (SDL), which involves several security-specific steps that programmers go through to make their software less liable to harbor bugs. From now on, said Arkin, Adobe will apply the SPCL methodology to some older sections of Reader and Acrobat, too.

"We're going to broadly look at the whole application, but focus on at-risk areas, where we'll do threat modeling, static code analysis and look for potential vulnerabilities," said Arkin, who refused to call that change a full-blown "code review," like the one Microsoft spent millions on to root out bugs in Windows XP.

"We're going to do a lot more pro-active work," he promised. "We want to shake loose vulnerabilities."

Adobe will also speed up its patching and communicate with users more frequently, Arkin said. The company was slapped by some in February for taking three weeks to fix the already-exploited bug, and then only for Reader and Acrobat 9; Adobe staggered the patch delivery for the other versions over several more weeks. A patch for a different zero-day vulnerability that Adobe issued this month was the first step toward that faster pace, said Arkin. "The fact that we were able to patch on May 12, and patch all [editions of] Reader and Acrobat on the same day, that's encouraging," he said.

Adobe will also mimic Microsoft by not only moving to a regular patch delivery schedule, but by going so far as to issue those patches on the same day as Microsoft. "Previously, we did patches on an as-needed basis," said Arkin. "But now we're going to offer them on a [quarterly] basis, and align them with the second Tuesday of the month. Feedback from our customers showed that was a better fit with their processes."

Arkin declined to specify a start date for the quarterly Reader and Acrobat security updates, saying only that they would kick off sometime this summer.

There are some things Adobe won't do, however. Only Reader and Acrobat are involved in the security revamping project, and Adobe won't consider disabling JavaScript in either application. Both recent zero-day vulnerabilities have involved JavaScript, which Adobe has recommended users temporarily switch off until a patch is available.

"No, we won't disable JavaScript by default," said Arkin when asked today. "JavaScript is a really critical feature for our enterprise customers." Instead, he countered that the other measures would result in more secure code while retaining JavaScript. "The code hardening effort will make sure JavaScript is as safe and secure to use as possible," he said.

"The way malware tries to attack people's machines has changed in the last six to twelve months," said Arkin in explaining why Adobe felt the need to revamp its security process.

There's no denying that hackers are exploiting Adobe bugs. According to Finnish security company F-Secure, patching 48.9% of all targeted attacks conducted this year involved a malicious PDF file attached to a legitimate-looking e-mail, a huge change from 2008, when PDFs made up just 28.6% of targeted attacks.

Andrew Storms, director of security operations at nCircle Network Security and a frequent critic of Adobe's practices, welcomed the moves, but wasn't ready to applaud Adobe just yet.

"The proof will be in six months or so," said Storms, "when we see the outcome. Will we see fewer bugs, fewer Reader zero-days? It's always that the proof is in the pudding. But it's welcome that another vendor has stepped up to better protect their customers."

Arkin has written an entry to Adobe's security blog that goes into more detail about the company's new-found Reader security religion.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags adobe readersecurity patchpdfadobe acrobatadobepdf bug

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?