Vulerability in Adobe Acrobat and Adobe Reader

On Friday, a "Zero Day" vulerability was disclosed for Adobe Acrobat and Adobe Reader. A zero day is a vulerability where an exploit is made public before there is a "patch" from the manufacturer.

 

In their advisory, Adobe said they were not going to patch the vulerability until mid-March for Acrobat/Reader 9, and "soon after" that for version 8, followed by an update for version 7 after that. This is rather troubling considering the vulerability is actively being exploited on the internet, including in targeted emails to company executives.

 

Adobe is relying on anti-virus vendors to catch the attacks. They will publish new security bulleting at http://www.adobe.com/support/security once the product updates are available, assuming that consumers will check there frequently for their respective updates.  

 

Symantec is already detecting the first wave as Trojan.Pidief (different versions). Kaspersky appears to be detecting these by the variants Exploit.Win32.Pidief. TrendMicro, who first received a sample on 2/11/09 added first definitions to the pattern on 2/20/09.  

 

In the meantime, users are counselled to turn off javascript in Acrobat/Reader, as task not likely to happen.  

 

Of large concern is that Acrobat/Reader configures Internet Explorer to open PDF files without user intervention. US-CERT recommends that this be disabled using the following registry edit. (save the following test to a .reg file and double click the file).  

 

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00

 

I’ve got a concern about that recommendation in that I see several other keys in th "AcroExch" range that may need the editflags values.

 

Considering the potential of the vulerability, my suggestion is that you keep your AV signatures up to date; very up to date. The first Adobe patch is over 2 weeks away.

User database on phpBB.com site compromised

Here is another example as to why we should have different user names and passwords for the various web site that we visit: http://area51.phpbb.com/phpBB/viewtopic.php?f=3&t=29973

This site is generally visited by those running phpBB boards. Hopefully, they don’t use the same password for the phpBB.com web site as they do on others.

Clickjacking Firefox and Chrome Exploit Proof of Concept released

A Proof of Concept (POC) has been released over a browser vulnerability that is expected to have a dramatic effect over internet use in the coming months; especially on "Web 2.0" sites. The popularity of sites like MySpace, LinkedIn, Tweeter, and Facebook are just a few examples of sites that come to mind. The attack method is one known as "Clickjacking". In most circles, if this was a MS PoC released, the anti-MS crowd would be sounding the  "0-Day" horn.

The term CLICKJACKING is a new one that you will see often in coming weeks, especially with a PoC made public. It has not been heard much outside security circles, and even then only in vague descriptions.

This method of attack is appealing to malware authors for many reasons. The biggest being the click. Clicks are money and an attack of this kind can cause your browser to "click" on numerous sites without your knowledge. It can also cause further "infection" for additonal clicks later.

It has been thought by many that newer browsers like Firefox, Chrome, and Safari are safe from browser attacks. This simply is a false sense of security. In fact, this POC targets Chrome and Firefox, and the latest IE8 is said to not be affected; nor is Opera v9.63 said to be.

Interestingly enough, with the introduction of IE8, Microsoft has been working on an anti-cross-site-scrioting technology built into their new browser, which some have linked to Clickjacking.

The potential for this type of attack is great. Spam, Phishing, Anti Virus 2009 installations are just of a few that quickly come to mind. To keep your computer safe, keep you AV up-to-date and be a bit less liberal with the "OK" those firewall warnings.

Read here and here for information.

More on this to come…