Top News Story:
Adobe PDF Security Problems
Adobe is currently working on security leaks in their Adobe Reader and Acrobat. These security breaches are happening on a regular basis. Hackers have been gaining remote-access to computers across the Internet through security flaws within their Adobe Reader and Acrobatt. As of this publishing there are no fixes available. Adobe is asking users to disable the JavaScript capability in their browsers and other programs. Once you click on a modified PDF file the hacker has complete access to your computer system.
Below is a reverse-chronological timeline of the PDF security issues, discoveries, updates and patches. The links below are just the major security flaws. There are others but they are too numerous to keep updated.
Click on the links below to view and read each article.
2009:
August
2009 August 3 - Security Advisor - Adobe Security PDF Security Leaks
May
2009 May 1 - Adobe.com - PDF Security Alert
2009 May 1 - SecurityForcet.com - PDF Notice
2009 May 2 - Adobe.com - Buffer overflow issues in Adobe Reader and Acrobatt
April
2009 April 28 - The Register.com - ZERO Day PDF Flaw
2009 April 28 - ComputerWorld.com - Adobe confirms PDF zero-day, urges users to kill JavaScript
2009 April 30 - Another Acrobat Reader Zero Day (BID 34740) - WordPress.com
March
2009 March 5 - Slashdot - PDF Vulnerability Now Exploitable With No Mouse Clicking
2009 March 4 - Didier Stevens - Video / How the PDF Exploit Works - Mouse-Over - No Clicking
February
2009 February 25 - ZNet - Adobe PDF Abuse Worsens
2009 February 24 - Eweek.com - Security Attacks Using Adobe PDF's in Advertisements
2009 February 20 - IBM Security - PDF Remote Execution Alert
2009 February 20 - Zero Day Vulnerability - Adobe says patch will be available in a few weeks
2009 February 19 - ADOBE ANNOUNCES CRITICAL SECURITY ALERT (This affects all versions of Acrobat Reader - Version 9 and previous versions)
2008:
2008 Decbember 12 - HP Communities
2008 December 4 - FindMySoft - Adobe Acrobat 9 Password Security Issues
2008 December 3rd - Softpedia - Adobe 9 Passwords Are 100 Time Less Secure
2008 November 17 - CarnegieMelon - Adobe Acrobat 9 Security Alert
2008 November 10th - TechWorld - Attackers Exploiting Hole in Acrobat
2008 November 8th - Core Security Technologies - Vulnerability Information
2008 November 6th - United States Department of Energy - Security Update
2008 November 6h - Gemini Security Solutions - Critical Acrobat Reader Vulnerability
2008 November 4th - Adobe Security Bulletin
2008 November 4th - U.S. Cert - Department of Homeland Security - National Cyber Alert
2008 - November 5th - ProductReviews - Adobe Security Patched 5 Months Late
2008 November 4th - TheRegister.com UK
2008 October 31st - Adobe Forums - Acrobat Reader 9
2008 June 25th - ZDNet Review - Adobe 9 "For Security-Minded Businesses..."
2008 June 24th - CNet.com - Adobe Release Security Updates
2008 May 9th - U.S. Cert - Department of Homeland Security - National Cyber Alert
2008 - May 8th - TUAW - Adober Reader Updates for Mac
2008 February 11th - IT Security Professionals
2008 February 7th - Adobe - Security Advisory - Security Updates
2008 February 2nd - Vupen Security - Advisory Details
2007: Adobe recommends updating to version 8.
2007 October 10th - Rueters - Reader Vulnerable to Hacks
2007 - January 9th - Adobe Support 1
2007 - January 9th - Adobe Support 2
2007 - January 7th - Top Tech News - Adobe Security Flaw
2007 - January 5th - ZNet.com - PDF Security Risk Greater Than Originally Thought
2007 - January 3rd - Symantec - When PDF's Attack
For the past few years computer systems have been vulnerable to Internet attacks when using the Adobe Reader while opening a modified PDF file. Once the PDF is open the computer hacker has access to your Username and Password. Think of it this way, when your phone rings you answer it. It's the same thing with the hacker. The hacker is notified that you have opened a modified PDF and they answer the call. Only this caller is taking remote control of your computer system. To date, there are ten (10) known ways to access your computer system using hacker code attached to a PDF file. You will not know when your system has been compromised until it is too late. Each of these security problems have been demonstrated to exist among computer hackers. Adobe has been notified about these concerns and they have released many patches to correct the problems. A small piece of code called, JavaScript, can sneak into your computer without you knowing it. Our research staff has spoken to some of the most knowledgeable Internet Security programmers working today. Each of them are in agreement that you will not know your system has been compromised until it's too late.
TESTIMONIAL - ""Any law firm specializing in Probate should have these forms. The software tremendously cuts the speed and time to setup new client documents. You can easily create a form, save the data and re-use the forms . The program is great!"
Christy - Pudyk Law Office, Macomb, Michigan
As you can see, opening a PDF form can lead to your computer being overtaken by a computer hacker. It's that fast. You will not know it is happening until it is too late.
Law firms are entrusted with the security and information of their clients information. Why chance opening your computer system to an Internet hacker that will remotely take over your system. Once your system is compromised you will no longer have control of your computer or your data files. This has nothing to do with anti-virus protection, spyware dectection programs or firewalls. Once you accept the agreement during the installation process you have created an open communication port on your computer to their company. Because you agreed to the terms of the software your computer protection programs do not see this communications port as a threat.
Why would anyone give you something for "free"? There is a trade-off. You get "free" software and in return the company gets information based on your browsing habits. The stories in the links above should at least make you reflect and think about this "free" strategy. Is it worth taking the chance of losing control of your computer system and your confidential computer data?
Note: If you are currently using Adobe Reader, either the free, standard or professional version of this product, you need to contact Adobe and update your software immediately.
Credits:
Vulnerabilities reported by Tavis Ormandy, Will Drewry (Google Security Team), cocoruder (Fortinet Security Research Team), Greg MacManus (iDefense Labs), Paul Craig (Security-Assessment) and Zero Day Initiative.