If you're a criminal and you want to break into a network, a common attack method is to exploit a hole in software that exists on most computers, has its fair share of holes, and isn't automatically updated.
In 2002, that would have been Windows. Today, it's likely to be Adobe Reader or Flash Player, whose share of vulnerabilities and exploits are on the rise while Microsoft's is falling.
Nearly half of targeted attacks exploit holes in Acrobat Reader, which is used to read PDF (portable document format) files, according to F-Secure. Meanwhile, the number of PDF files used in dangerous Web drive-by attacks jumped from 128 during the first three and a half months of last year to more than 2,300 during that time this year, the company said.
In addition, there are more and more zero-day holes, vulnerabilities that are public before a patch is available. Like sitting ducks, users of affected software are left wide open to attack until a fix is available.
There have been zero-day exploits for the Flash Player plug-in, used for viewing rich media like videos and interactive charts on Web sites. And in one case this spring, a zero-day hole in Adobe Reader spurred security experts to recommend that users disable JavaScript.
One security researcher at the Black Hat security conference, who asked to remain anonymous, said: "As a result of the number of zero-day attacks on PDFs this year, large banks hate Adobe."
Those scary statistics prompted F-Secure researcher Mikko Hypponen, chief research officer at F-Secure, to urge Adobe Reader users to switch to an alternative PDF reader at the RSA show in April.
Adobe "has a lot to learn from, of all places, Microsoft," Hypponen said at the time. At the recent Black Hat and Defcon security shows, others concurred.
"Adobe is the next Microsoft," said Roel Schouwenberg, a senior antivirus researcher at Kaspersky. "They are slowly realizing that they have become a main vector of getting into a machine...We as an industry must push hard" to get Adobe to improve security.
An Adobe manager said the problem stems from the fact that its software is so broadly used.
"It's only natural, given the fact that some of our products like Reader and Flash Player are some of the most widely distributed on Earth, that they would be targeted by attacks," Brad Arkin, director for product security and privacy at Adobe, said.
Microsoft has been in the same boat, and in many ways still is. The difference is in how the companies respond to the problem, experts said.
Microsoft: Been there, done that
In January 2002, Bill Gates launched the Trustworthy Computing initiative and said security would be a top priority for the company. Microsoft had to do something to combat the negative press and public opinion over its whack-a-mole strategy for countering the viruses and other security holes that plagued its software.
The company established a Software Development Lifecycle program, designed to build security into the software, that has become the standard others in the industry follow. It is roundly lauded for its efforts.
Now it's Adobe's turn to step up to the plate.
"Microsoft is a model for patch management...they were forced into it. They really turned around," Hypponen said in an interview at the Black Hat conference. "Now, Flash and Reader are ubiquitous and it's harder and harder to target Microsoft, so the attackers are looking for easier targets."
In particular, Adobe's patching process isn't as robust as Microsoft's, he and others said.
In all fairness, Adobe is on the right path. Prompted by a zero-day hole in Reader, Adobe decided in May to start releasing patches on a quarterly basis, and to schedule the updates to coincide with Microsoft's Patch Tuesday releases.
At the time of the Adobe announcement, Arkin said the company was reviewing "everything from our security team's communications during an incident to our security update process to the code itself". He also promised that users would "see more timely communications regarding incidents, quicker turnaround times on patch releases, and simultaneous patches for more affected versions as we move forward."
The company was the first third-party vendor to release a fix for software affected by a vulnerability in Microsoft's Active Template Library, which is used to build components for Web applications and which was being exploited, according to Arkin.
"We scoured the entire Adobe portfolio and evaluated more than 200 products in the field today to determine which might be vulnerable," he said, adding that fixes for Shockwave Player and Flash Player shipped within weeks.
A zero-day exploit targeting Reader and Acrobat that Adobe learned about on April 27 was fixed about two weeks later, he said. And Adobe issued a patch late last month for a critical Flash Player problem that was being exploited, allowing attackers to take over a computer via content viewed in a browser.
"We are quite happy with the performance on those," Arkin said of the time frame for the patches.
The company also has been turning an eye toward "digging into legacy code" and looking for additional ways to improve products overall he said. "Adobe integrates the best practices you see at Microsoft and other companies."
The security researcher who asked not to be named complained that at an architectural level, some Adobe applications have too much access to the operating system. "Why should something that operates on untrusted data have full access to your trusted data?" he asked, mentioning specifically Adobe Reader and its ability to access the hard drive to read and write files.
The program's functions require it to be able to save and open files on the file system and thus have read and write access to the hard drive, Arkin said. "Web browsers all have the ability to save to the file system," and the privileges between the two types of programs are similar, he added.
Security-versus-functionality trade-offs aside, changes in Adobe's products and processes will come in response to market pressures and not merely because it's the favorite target for attackers, said Bruce Schneier, chief technology officer of BT Counterpane.
"This is all very much a business decision, whether the company decides to take security seriously or not," he said, adding that he spent his day dealing with Adobe updates.
"I'd like to think that they would start realizing that they can use security as a selling point, but it took Linux to get Microsoft to do that. They felt they had competition," he said. "Is there a Linux waiting to affect Adobe?"
Not really, the experts agreed.
Dan Kaminsky, director of penetration testing at IOActive, praised Adobe for "reconfiguring itself" with regards to security issues and suggested critics should cut the company some slack.
"The PDF exploitation only recently blew up, and remember, it takes any software development house a while to really address problems," he said, adding that Flash 9 was much more secure than Flash 8.
"Does Adobe have products they need to lock down? Yes. Are they in the process of doing so? Yes. They did it for Flash and they'll do it for Reader," he said.
"There's always a 'most vulnerable' attack surface."
This article was first published as a blog post on CNET News.
Play video
Adobe: Time to step up security plate?
It will take Adobe years to undo the years of neglect for security best practices. And, if the researchers from Radware are proven correct about the new kinds of attack surfaces in plug-in-like software, Adobe's challenge is far greater.
Consequently, we are looking at a security evolution from Adobe, which means years and years of patch after patch. Implementing patches is so important that many folk consider utilizing auto-update features in software as a sound security best practice.
However, as other researchers from DefCon 17 pointed out: careful what you wish for. In short, software vendors took too many short-cuts with their auto-updates:
www.blueridgenetworks.com...
The walk-away is that an auto-update feature enabled and running on a machine using hotel broadband, for example, may result in a practically impossible to detect malware infestation.
Adobe products are everywhere and they are relatively complex. As a small security software vendor, we considered them a top tier risk to our target market: the world. Given that typical anti-virus/spyware products are less and less able to intercept attacks that exploit programming mistakes in software applications, we built our AppGuard security software product with Adobe products specifically in mind.
Posted by Eirik Iverson on Tuesday, August 11 2009 11:38 PM