Adobe bolsters security in Reader, Acrobat XI with added features

Adobe Reader and Acrobat XI have a better sandbox and new security features that can block more attacks, Adobe says

The recently launched Adobe Reader and Adobe Acrobat XI come with new security features and an improved sandbox that will make the products harder to attack and exploit, according to Adobe.

The sandboxing feature known as the Protected Mode that was first introduced in Adobe Reader X proved successful at mitigating traditional PDF exploits. The technology works by isolating certain Adobe Reader operations in a strictly controlled environment and makes it very hard for attackers to write and execute malicious code on a system after exploiting a vulnerability in the product.

"Since we added sandbox protection to Adobe Reader and Acrobat, we have not seen any exploits in the wild that break out of the Adobe Reader and Acrobat X sandbox," Priyank Choudhury, a security researcher within Adobe's Secure Software Engineering Team, said Wednesday in a blog post.

However, this doesn't mean that the Adobe Reader X sandbox can prevent all types of attacks. For example, the sandbox was primarily designed to restrict write operations, not read ones, which means that potential attackers can steal sensitive information from a system after exploiting an Adobe Reader X vulnerability.

That's no longer a problem in Adobe Reader XI, Choudhury said. "In Adobe Reader XI, we have added data theft prevention capabilities by extending the sandbox to restrict read-only activities to help protect against attackers seeking to read sensitive information on the user's computer."

"I've warned before that Adobe Reader X's sandbox is a write sandbox, e.g. that reading is still fully permitted and thus still allows stealing of information," Didier Stevens, a security researcher well known for his PDF security work, said Thursday via email. "I tested that."

Stevens assumes that the new sandbox model in Adobe Reader XI prohibits the reading of files and registry keys, but hasn't had a chance to test it yet. If that's the case, it would be an important improvement, he said.

The new version of Adobe Reader also comes with a Protected View mode that further strengthens the sandbox by creating a separate window station -- a separate securable clipboard and desktop -- for the PDF viewing process. This function is designed to block so-called screen-scraping attacks in which one application reads data from the display output of a different program running on the same desktop.

Adobe Acrobat already had a Protected View mode that has been enhanced in the new version. "Protected View behaves identically for Adobe Reader and Acrobat, whether viewing PDF files in the standalone product or in the browser," Choudhury said.

The support for Address Space Layout Randomization (ASLR), a memory-based anti-exploitation technology, has also been improved in the new Adobe Reader and Acrobat versions.

ASLR can be tricky to implement in a program, because all of its executable files and dynamic link libraries (DLLs) need to support it for the protection to be fully effective.

"In Adobe Reader and Acrobat XI, we have enabled support for Force ASLR on Windows 7 and Windows 8," Choudhury said. "Force ASLR improves the effectiveness of existing ASLR implementations by ensuring that all DLLs loaded by Adobe Reader or Acrobat XI, including legacy DLLs without ASLR enabled, are randomized."

In addition, Adobe Reader and Acrobat XI benefit from a new PDF Whitelisting Framework that will allow system administrators, especially in enterprise environments, to enable specific functionality like JavaScript only for select PDF files, sites or hosts.

Many security researchers recommend disabling JavaScript support in Adobe Reader and Acrobat because most PDF exploits require JavaScript to work. However, this functionality can also have legitimate purposes, so disabling it for everyone in an enterprise environment might be impractical.

The new Adobe Reader and Acrobat XI also have support for content digital signatures that use Elliptic Curve Cryptography (ECC). "Users can now embed long-term validation information automatically when using certificate signatures and use certificate signatures that support elliptic curve cryptography (ECC)-based credentials," Choudhury said.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?