Is Adobe the next (pre-2002) Microsoft?
If you're a criminal and you want to break into a network, a common attack method is to exploit a hole in software that exists on most computers, has its fair share of holes, and isn't automatically updated.
In 2002, that would have been Windows. Today, it's likely to be Adobe Reader or Flash Player, whose share of vulnerabilities and exploits are on the rise while Microsoft's is falling.
Nearly half of targeted attacks exploit holes in Acrobat Reader, which is used to read PDF (portable document format) files, according to F-Secure. Meanwhile, the number of PDF files used in dangerous Web drive-by attacks jumped from 128 during the first three and a half months of last year to more than 2,300 during that time this year, the company said.
In addition, there are more and more zero-day holes, vulnerabilities that are public before a patch is available. Like sitting ducks, users of affected software are left wide open to attack until a fix is available.
There have been zero-day exploits for the Flash Player plug-in, used for viewing rich media like videos and interactive charts on Web sites. And in one case this spring, a zero-day hole in Adobe Reader spurred security experts to recommend that users disable JavaScript.
One security researcher at Black Hat last week, who asked to remain anonymous, said: "As a result of the number of zero-day attacks on PDFs this year, large banks hate Adobe."
F-Secure said it identified about 1,967 targeted attack files in 2008, the most popular type being .doc used in Microsoft Word.
(Credit: F-Secure)Those scary statistics prompted F-Secure researcher Mikko Hypponen, chief research officer at F-Secure, to urge Adobe Reader users to switch to an alternative PDF reader at the RSA show in April.
Adobe "has a lot to learn from, of all places, Microsoft," Hypponen said at the time. At the Black Hat and Defcon security shows last week, others concurred.
"Adobe is the next Microsoft," said Roel Schouwenberg, a senior antivirus researcher at Kaspersky. "They are slowly realizing that they have become a main vector of getting into a machine...We as an industry must push hard" to get Adobe to improve security.
An Adobe manager said the problem stems from the fact that it's software is so broadly used.
"It's only natural, given the fact that some of our products like Reader and Flash Player are some of the most widely distributed on Earth, that they would be targeted by attacks," Brad Arkin, director for product security and privacy at Adobe, said in an interview on Wednesday.
Microsoft has been in the same boat, and in many ways still is. The difference is in how the companies respond to the problem, experts said.
Microsoft: Been there, done that
In January 2002, Bill Gates launched the Trustworthy Computing initiative and said security would be a top priority for the company. Microsoft had to do something to combat the negative press and public opinion over its whack-a-mole strategy for countering the viruses and other security holes that plagued its software.
The company established a Security Development Lifecycle program, designed to build security into the software, that has become the standard others in the industry follow. It is roundly lauded for its efforts.
During the first three months of 2009, F-Secure discovered 663 targeted attack files, the most popular type being PDF. The change from the previous year is primarily due to the fact that there have been more vulnerabilities in Adobe Acrobat/Reader than in Microsoft Office, F-Secure said.
(Credit: F-Secure)Now it's Adobe's turn to step up to the plate.
"Microsoft is a model for patch management...they were forced into it. They really turned around," Hypponen said in an interview last week at Black Hat. "Now, Flash and Reader are ubiquitous and it's harder and harder to target Microsoft, so the attackers are looking for easier targets."
In particular, Adobe's patching process isn't as robust as Microsoft's, he and others said.
In all fairness, Adobe is on the right path. Prompted by a zero-day hole in Reader, Adobe decided in May to start releasing patches on a quarterly basis, and to schedule the updates to coincide with Microsoft's Patch Tuesday releases.
At the time of the Adobe announcement, Arkin said the company was reviewing "everything from our security team's communications during an incident to our security update process to the code itself." He also promised that users would "see more timely communications regarding incidents, quicker turnaround times on patch releases, and simultaneous patches for more affected versions as we move forward."
The company was the first third-party vendor to release a fix for software affected by a vulnerability in Microsoft's Active Template Library, which is used to build components for Web applications and which was being exploited, according to Arkin.
"We scoured the entire Adobe portfolio and evaluated more than 200 products in the field today to determine which might be vulnerable," he said, adding that fixes for Shockwave Player and Flash Player shipped within weeks.
A zero-day exploit targeting Reader and Acrobat that Adobe learned about on April 27 was fixed about two weeks later, he said. And Adobe issued a patch last week for a critical Flash Player problem that was being exploited, allowing attackers to take over a computer via content viewed in a browser.
"We are quite happy with the performance on those," Arkin said of the time frame for the patches.
The company also has been turning an eye toward "digging into legacy code" and looking for additional ways to improve products overall he said. "Adobe integrates the best practices you see at Microsoft and other companies."
The security researcher who asked not to be named complained that at an architectural level, some Adobe applications have too much access to the operating system. "Why should something that operates on untrusted data have full access to your trusted data?" he asked, mentioning specifically Adobe Reader and its ability to access the hard drive to read and write files.
The program's functions require it to be able to save and open files on the file system and thus have read and write access to the hard drive, Arkin said. "Web browsers all have the ability to save to the file system," and the privileges between the two types of programs are similar, he added.
Security-versus-functionality trade-offs aside, changes in Adobe's products and processes will come in response to market pressures and not merely because it's the favorite target for attackers, said Bruce Schneier, chief technology officer of BT Counterpane.
"This is all very much a business decision, whether the company decides to take security seriously or not," he said, adding that he spent his day dealing with Adobe updates.
"I'd like to think that they would start realizing that they can use security as a selling point, but it took Linux to get Microsoft to do that. They felt they had competition," he said. "Is there a Linux waiting to affect Adobe?"
Not really, the experts agreed.
Dan Kaminsky, director of penetration testing at IOActive, praised Adobe for "reconfiguring itself" with regards to security issues and suggested critics should cut the company some slack.
"The PDF exploitation only recently blew up, and remember, it takes any software development house a while to really address problems," he said, adding that Flash 9 was much more secure than Flash 8.
"Does Adobe have products they need to lock down? Yes. Are they in the process of doing so? Yes. They did it for Flash and they'll do it for Reader," he said.
"There's always a 'most vulnerable' attack surface."
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
%20Microsoft?%20%7C%20InSecurity%20Complex%20-%20CNET%20News&srcUrl=http://news.cnet.com/8301-27080_3-10304455-245.html){kind=small}
I completely agree with @tektaktyks. It all comes down to how many people use the software. If only 10% use then what's the justification of an attack. The most vulnerable product right now is the iPhone being the hottest toy in the market.
There is no software on the planet which is 100% secure (and that includes UNIX). After all, software is developed by humans and nobody is perfect. What matters is how soon can you acknowledge the problem and equally how soon you can resolve it. Microsoft and Google have always been good at that. Apple on the other hand - well, need I say more. the most recent example with the bug on the iPhone SMS which Apple wouldn't even acknowledge until it released the patch for it in spite of knowing the issue since the person who found the bug had contacted Apple first before releasing it to others.
Who's better now?
In 3 different programs.
Adobe has more vulnerabilities in one single program then Microsoft has in 3 of them.
@dmac81 before posting read and analyze what is being said this 1 vs 3 App. And it is just a reader with no editing functionality, compared to 3 most highly used and versatile application.
"Microsoft by those graphs is still over 50% of attacks!"
>> The question is, 50% of what? The graphs just show 4 apps -- Word, Excel, PowerPoint, and Acrobat Reader. It's only analyzing file-types -- otherwise it would make sense to include Flash as well (which will reduce the % of all these 4 apps to a really small fraction). Or say Quicktime (which will give Flash some good competition). Also note that the graph doesn't take into account the ubiquity of each doc type. While each of these file formats is very widely used, word probably has the largest share by a huge margin, with PDFs next, excel next, and powerpoint next (pure speculation on my part of course -- but the point about not interpreting the graph literally remains valid).
Troll On!!!
Rebuild your os every 3 months? You clearly must be doing something wrong then.
I love how you mention freedom with Apple.
How is it really freedom though? I mean they tell you what hardware you can use hardly what I would call freedom.
Adobe do need to sort it's house out. dearadobe.com is a good place that list lots of peoples gripes about Adobe. Acrobat reader and the authoring software is the biggest bit of bloatware on most peoples machines and most people only use it to look as documents with text, images and the odd link. It's all the scripting, video and interaction stuff the have rammed into PDF's to sell the next generation of authoring software that has caused most of the problems.
The more bloated it is the harder it is to find the errors. Adobe need to get back to pdf's being the simple light weight online document format is started with.
And don't get me started on CS 4. a total waste of money which did not fix any of the security and performance problems that has crept into it's product range. Rather than concentrating on making more software collections than there are versions of windows, they need to get cheaper, lighter and much more reliable software that people want to by and keep up to date.
Otherwise Powerpoint, Excel and Word will soon become safer to use than Acrobat! That could kill Adobe....
Do you have any evidence to prove that?
I like most others get their Adobe or Microsoft updates for free. If you have to make up information just so you can have something to complain about then your comments and your integrity are worthless.
"Do you have any evidence to prove that? "
It would not take me to long to put together a list of bugs that have not got fixed. Maybe it should have been 'Making customers pay for minor updates without fixing the bugs" ;)
a. Get a life
b. Improvise and blame the economy
Same can be said for Apple.
Then there's the problem of rich internet applications (RIA). Web browsers represent disparate runtimes, each with its own quirks and behaviour. Even if all versions of IE were to drop off the face of the Earth, there are still significant differences among Firefox, Safari, Chrome and Opera. Flash, on the other hand, represents a cross-browser and cross-platform runtime that anybody can develop, test, QA, and deploy. This means Flash web applications can be delivered more quickly than HTML/CSS/JavaScript ones.
Silverlight brings the same problems as Flash, since it's also a proprietary technology. Yeah, parts of FlexBuilder are open source, but the Flash runtime is completely closed source, and alternative implementations of the runtime are prohibited by the license. The only RIA framework that has a snowball's chance in hell of being open sourced is JavaFX, but all bets are off once Oracle completes its acquisition of Sun.
@w0rdwarri0r YouTube not having an HTML 5 site ready to go is not surprising considering that HTML 5 is still a draft and support in browsers is still fairly new and support only a subset of features. Not to mention they're still bickering over codecs.
http://ideas.acrobat.com
that was unneccessary
Until there's a competitor to Acrobat that's cross platform, has 85-90% of it's functionality, is less bloated and much more secure, I think we can count on Adobe to maintain their current practices. After all, what else are you going to use in place of PDF? XPS? Ha!
both free, both lightweight compared to adobe's.
In my opinion, all software is vulnerable to hackers. If you don't take precautions, use good judgement or take the time to learn how to safeguard against these attacks, you deserve what you get. Kind of like driving without a insurance if you ask me. Soooooooo... I guess the next question would be.... how many of you complaining about Adobe here are using a Windows platform?
A good guess would be all of you. : )
To Adobe... rock on. Your software suite is so well integrated and functional it allows me to make every working minute of my day profitable in more ways than I can count. Fix problems where they may be, but don't change a thing. On my end, I will make sure that I am careful how I use my computer so that any small inadequacies there may be with your wonderful software is not an issue for me to worry about. Thanks again for all your hard work geared towards the creative industries.
Adobe also offers a lot of features on the Windows versions of CS4 that aren't in the Mac versions. The Mac versions don't even include a 64-bit version yet (though that's mainly because Apple still hasn't released a proper 64-bit OS and has had a ridiculously confusing 64-bit developer story over the last years).
"Windows is.... A 64-bit shell for a 32-bit extension to a 16-bit graphical interface, sitting on an 8-bit operating system, originally written for a 4-bit processor by a 2-bit company without ONE BIT of common sense."
Adobe makes up nearly 50% in just one.
I do use CS4 on Windows. I appreciate how well integrated the components of the suite are. Adobe's CS suites are amazing, wonderful, and well thought out. While I have no complaints overall, I do have concerns.
I don't open or view .pdf attachments sent to me via email from unknown sources so I can minimize that attack vector. Flash though is a different story. It's so prevalent on the web and in most cases the vulnerabilities are drive-by requiring no user interaction.
I can control Flash in web browsers by using add-ons that limit its scope. However, Flash plug-ins in CS4 are widespread and the versions vary. That's where my biggest concerns are.
When I scan my Windows system with Secunia PSI, it flags the following CS4 apps as being vulnerable due to the versions of Flash in use:
Adobe AIR Flash 10.x Plug-in
Adobe AIR Flash 9.x Plug-in
Bridge CS4 Flash 9.x Plug-in
Contribute CS4 Flash 10.x Plug-in
Device Central CS4 Flash 9.x Opera Plug-in
Dreamweaver CS4 Flash 10.x Plug-in
Extension Manager CS4 Flash 9.x Plug-in
As of this time apparently these Flash plug-ins have not yet been updated. I can only hope it's not an issue.
I can't comment on the differences between CS4 on Mac OSx versus the Windows platform as I haven't used CS4 on the Mac. However, you might find this review from Ars Technica of interest:
http://arstechnica.com/apple/news/2008/10/adobe-cs4-review.ars
It's important to note that the figures being shown here are referring to infected file types. However, getting the user to open a .DOC file is generally considered to be a trickier proposition than, for instance, getting them to open a PDF (which Adobe has set up to open inside the browser on most systems without the same level of warnings you'd get for an Office doc). Exploits in HTML e-mail are even more troublesome, because they can attack the e-mail program just by having the user click on the e-mail. Thankfully, the Outlook / Office HTML e-mail code has proven quite resiliant against attacks.
"An Adobe manager said the problem stems from the fact that it's software is so broadly used. "
While the story may be well researched and written, its credibility quickly goes out the window due to the inexcusable error from both the writer and CNET editors.
"It's" ALWAYS = "it is" -- never the third-person possesive pronoun. NEVER.
- by BrandonLive August 7, 2009 11:23 AM PDT
- Actually it's "Secure Development Lifecycle" ;)
- Like this Reply to this comment
-
Showing 1 of 2 pages (58 Comments)Arkin is incorrect. The most security-focused web browsers on Windows do NOT have write access to the file system (except for the "Low Integrity Temporary Internet Files" directory). Those would be IE and Chrome, which both run their tab processes in isolated Low IL sandboxes.
Adobe is perfectly capable of making Acrobat Reader run in Low IL the same way, they just haven't yet taken on the effort to do so.