Posted by: Eric Hansen
While stories like these tend to get old to me, this one is an exception, because it shows that a dog’s old tricks can still prove to be worth points.
Now, there’s two people at fault here, in my eyes:
1 – Adobe: The exploit’s been there since AcrobatPDF v9. While not every bug will be found, I have a hard time believing it was safe for that many years (going on 5 years [2008-2013] now).
2 – The government agencies: I just have this increasingly sinking feeling that this is due to them still using v9, when v11 is out in the public as stable now. Why?
The article also mentions the attack being found in America as well, but doesn’t do much to touch on it. I guess which makes sense, since most of the attacks in the article are in the EU. But, in the article, it states that the writers found a way to bypass sandboxing. This isn’t new methodology, and in fact is quite old. So, why haven’t these been fixed? Heck, Adobe’s software has been under the gun quite a bit past few years due to countless number of attacks (think Java). Every month there seems to be a new 0-day out for one of their products. I feel moving to a different PDF reader, though, won’t fix the problem. PDF is a pretty standardized format. The issue should be addressed of the readers themselves detecting corrupted PDFs and not allowing them to load.
Is it that simple? Knowing my luck, probably not. But one can dream.