Forum Moderators: travelin cat
Yeah, even Mac people need to be aware of this. I just finished my patch into Snow Leopard and it was easy.
If you really want to get into it:
[isc.sans.org...]
It appears that the initial attack vector on Google (and 20+ other companies!) was probably a malicious PDF document.
It seems, yet again, the lesson is to avoid Acrobat.
the UPDATE.CAB file drops another executable that injects a DLL into Internet Explorer
It seems, yet again, the lesson is to avoid Acrobat.
No, the lesson is and always has been:
1. Don't open files from unknown senders
2. Beware files on untrusted sites
3. Disable javascript except on whitelisted sites
4. Avoid Internet Explorer as much as possible
Please someone mention how to do it - I've forgotten, and it's not disabled as default.
Be sure to uncheck that box if you don't want McAfee to self-install. Shame on Adobe for setting it up this way.
dc
Control click on any .pdf file
Choose "Open With"
Scroll to the bottom of the list and choose "Other..."
Click on the check box in the bottom of the window that says "Always Open With"
Navigate to your Application folder and click on Adobe Acrobat Professional.
From this point on, every .pdf file will be opened with Acrobat Pro
To disable JavaScript:
File -> Preferences
Under Categories, click on JavaScript
To the right, uncheck the box next to "Enable Acrobat JavaScript"
Adobe makes industry standard software in many design/publishing areas. I wonder how much longer they can ride that wave before people scream and holler for an alternative and possibly settle for a lesser product just to get away from them.
There are some PDF's out there that have nifty interactive forms, that put JavaScript to good use. Adobe competes with Word forms that way. But Preview is enough for me.
This is 100% on Adobe, who released a shoddy and insecure Javascript engine where no normal person would want or expect it to exist anyway. Their entire reader is a sad joke that a decade later still brings my computer to a crawl when I have to load a .PDF document, but that's another thread.
Good advice from incrediBILL, thanks.
1. Don't open files from unknown senders
2. Beware files on untrusted sites
3. Disable javascript except on whitelisted sites
4. Avoid Internet Explorer as much as possible
I agree, but Acrobat seems to be to PDF, what IE is to HTML.
After all, every time we visit an untrusted site, our web browsers are opening files from it, and we expect
then to be secure.
(I've never figured out why it would be useful to have javascript in something that is essentially a printer friendly format).
Forms.
Some of the other readers are implementing Javascript because otherwise they cannot replace Acrobat Reader in some environments.
But anyway, it's in there and it'll be years before most people have updated to a more secure release.
After all, every time we visit an untrusted site, our web browsers are opening files from it, and we expect
then to be secure.
No, I never expect an untrusted site to be secure, that's why it's called UNTRUSTED.
Considering the large quantity of hacked sites on shared services, approaching them as anything but potentially hostile is a bad idea.
That's why many of us surf with javascript and other features disabled unless it's whitelisted.
The internet is no different than the real world, you never know what kind of neighborhood you're in until you get car jacked (or worse) and by then it's too late so be careful.
