F-Secure Says Stop Using Acrobat Reader
Source: Tom's Guide US | Keywords: Adobe, Acrobat, Reader, Malware
F-Secure is claiming that Adobe's default PDF reader is insecure, and advises Internet users to use alternate programs.
During the RSA Conference (2009) held this week, F-Secure's chief research officer Mikko Hypponen told the press on Tuesday that consumers should not use Adobe's Acrobat Reader, but rather switch to an alternate application to read PDF files. Those are strong words, especially when most consumers have Acrobat Reader installed and set as the default PDF application. However, according to Hypponen, 47-percent of the targeted attacks in 2009 have exploited holes in the program; six vulnerabilities have been discovered in Reader so far (SA29773) this year.
Hypponen went on to warn that Adobe Reader is the new Internet Explorer (6), referring to a time when security experts told consumers to switch to another browser due to huge security holes in Microsoft's browser. By getting rid of Reader, he said that consumers will reduce their risk of acquiring malicious code and infecting the PC. "That's my advice," Hypponen said. "I don't expect a Christmas card from Adobe."
PDF files can be especially dangerous to consumers and executives who are accustomed to receiving files in that format. Recipients of an infected PDF merely open the file via Acrobat Reader and activate the embedded malicious code (aka a "targeted attack"), opening a back door in the PC and allowing the attacker to steal sensitive data. Security flaws in the Adobe Acrobat Reader browser plugin also allows the attacker to come in and create a back door, termed as a "drive-by download," when the end user downloads a PDF from a "tainted" website.
Unfortunately, the problem is getting worse. According to Hypponen, F-Secure saw 128 "dangerous" drive-by attacks between Jan 1 and April 16, 2008. In the same time frame this year, F-Secure has seen 2,305 drive-by attacks. To alleviate the problem, Hypponen suggested that Adobe should make security a priority, and to take notes from Microsoft whom releases monthly security patches on a regular basis. Unfortunately, consumers aren't fully aware that Adobe's Acrobat Reader requires updating in a security sense, and often avoid installing crucial updates when the program alerts the end-user of a new patch.
For now, Hypponen suggests that consumers stop using Reader altogether, and locate a compatible program by heading to this website. Are these programs more secure? That's a good question, however, like Firefox and the other non-Internet Explorer browsers, they're not currently in the hacker-oriented spotlight. Still, come this holiday season, it will not be surprising to see Adobe sending Hypponen a Christmas card PDF to his email inbox.
-
Previous News Article
Apple Cuts 1,600 Retail Workers,... -
Next News Article
Samsung Unveils Phone Running...
What's the best alternative to Acrobat?
I'm using Foxit Reader. It's very much like Adobe Reader, only slightly faster and much smaller.
Not to mention a bloated piece of junk. I use Sumatra PDF, It's a no frills PDF reader. All in a little over 1 MB.
I don't understand why we haven't moved away for the pdf format in the first place. It is only slightly less outdated than the fax machine. Adobe also has so much bloat in their software, it slows down the majority of business/office machines far more than it should. To think that anyone thinks reader or pdf formats are secure is just sad.
According to Slashdot, he suggested readers from http://pdfreaders.org/.
You need to upgrade your equipment.
I have had speed problems when printing through slow ass print servers.
Newer canon Image Runners and xerox color machine do not have the speed problems like they used to.
I know what mean though, nothing like watching a 200MB PDF spool for an eon whilst trying to hit a deadline.
I'm running foxit as well. It's not just a little faster, it's a TON faster compared to adobe's acrobat. It also has an add on extention to create PDF's as well, for a price. Foxitis just better.
I just tried two alternatives:
Okular: Required some kind of KDE compatibility layer that wouldn't install.
SumatraPDF: Worked fine for viewing simpler documents. When I opened a very complex document (a vectorized map of all the city bus lines in my city). Rendering took a very long time, especially when zooming, and the program used nearly 1GB of RAM during the process (but gave it all back once the rendering was completed). Also some effects like shadows didn't seem to display properly or at all.
Foxit: Faster than Acrobat Reader, used slightly less memory. Shadows are displayed properly. It wanted to install some spyware "toolbar" but gave the option to say no (at the expense of some features). I'll definitely switch to this on my Netbook, provided it's compatible with Firefox as a plugin. It struggles a bit with Acrobat Reader. Not sure about my desktop system - I've got a quad core CPU and RAM to spare, and Acrobat has never given me any problems.
I'm running foxit as well. It's not just a little faster, it's a TON faster compared to adobe's acrobat. It also has an add on extention to create PDF's as well, for a price. Foxitis just better.
+1. Same here. Only reason I have the Adobe 3D installed is because of my CAD software.
wow, switching right now! thx for the article!!!
if adobe acrobat is insecure, what about adobe flash or shockwave, ect. they must be bigger holes! should we uninstall them too, or find alterantives?
Foxit all the way, once had an issue with compatibility, emailed them, it was fixed in the next release. Awesome company that cares about it's users, even the free ones.
one way to make adobe acrobat is to change configuration defaults. you can disable adobe scripting, you can enable security, you can disable documents starting external programs, ect. and i thought i was secure, ;-)
I don't understand why we haven't moved away for the pdf format in the first place. It is only slightly less outdated than the fax machine. Adobe also has so much bloat in their software, it slows down the majority of business/office machines far more than it should. To think that anyone thinks reader or pdf formats are secure is just sad.
Agreed.
SVG is a much better format, and it's open so anyone can create a file without buying proprietary software.
So we should make something else popular, and therefore the new target for attacks?
“All of this has happened before and all of it will happen again”
-BSG
I've never liked PDFs
if I must read one, I always download it and convert it to html
much easier to work with in html format
So we should make something else popular, and therefore the new target for attacks?“All of this has happened before and all of it will happen again”-BSG
I'm not saying we should change for security reasons, I'm saying we should change because PDF sucks as a format, not to mention it's closed and proprietary, I don't feel I should have to pay money to save a document in the PDF format. SVG can do everything is can, and it can do it better.
Althought, from a security stand point, Inkscape (the more prominent SVG editor) is much safer as it doesn't connect to the internet for any purpose. Not to mention SVGs are just XML documents that can be made by hand (if you were really paranoid about security).
Not trying to be a fanboy here, but I've got XP Pro and Ubuntu on my laptop. In XP I'd been using the traditional Adobe Acrobat PDF reader. In Ubuntu, the default PDF reader is something called Evince.
The difference between the two is like NIGHT and DAY. Ever since using something other than Acrobat, I've shed most of my dislike for PDFs since they don't lock my system up while opening. The problem lies with Acrobat: PDFs aren't (quite as) terrible.
I'm not saying we should change for security reasons, I'm saying we should change because PDF sucks as a format, not to mention it's closed and proprietary, I don't feel I should have to pay money to save a document in the PDF format.
PDF is an open standard: ISO 32000-1:2008 in particular. OpenOffice.org has built-in PDF export that's free.
On Ubuntu Linux I use Evince for viewing PDFs as it is much faster than Adobe Reader but doesn't support forms as well.
PDF is the industry standard for engineering data and manuals. It took 15 years to get there and isn't going away anytime soon. How often do you see XPS documents on the web?
I've disliked their products since Day One. Especially the unasked-for desktop icons and auto-updates.
Besides all the manuals and engineering data, the legal world, HR departments, general office documents... It was the first practical locked document, now it's way big and a target. Companies don't like changing programs because they will have to provide training no matter how simple the conversion because most people don't react well to change and most are not computer whizzes, plus the time to recreate forms, compatibility with customer systems, not to mention the IT departments will have to make sure there are no software compatibility problems or security issues as well. All that cost money. Many have proprietary software so it's not so simple of conversion for them. They expect a fix and will wait for it. Adobe has too much to lose so they will fix it.
It's not that Acrobat is popular, it's that Adobe are absolute cunts, all of their products come with backdoors and phone home whether you want them to or not. Not to mention they're greedy bastards, you should see how they treat their corporate customers... talk about biting the hand that feeds you...
So, of the free Windows PDF readers, are any open source? I use Linux, but I'd like to know what to recommend to others...
I've been using Foxit for about a year now. It opens so much faster, takes up WAY less hard drive space, and has a smaller memory/processor footprint. Since I'm on a rather old computer, that's a big selling point.
So, of the free Windows PDF readers, are any open source? I use Linux, but I'd like to know what to recommend to others...
Sumatra is open source. GSview is a front-end for Ghostscript on Windows, but I hear it's nag-ware.
That's what happens when you keep installing unnecessary background processes on users machines. If the holes are in those processes, and you keep it running, you're vulnerable for all the time your machine is opened and connected to the internet. And Acrobat tends to install those kind of agent processes, which supposedly makes the program faster to start (even with that agent Acrobat is slower than say Foxit) and keeps it automaticly up to date. No thanks Acrobat. And grats to the hackers to have found so many holes in that piece of shit.
The pdfreaders.com (which you link to in the article) recommends xpdf and kpdf. Fact is, those pdf viewers recently had to fix security holes very similar to those present in Acrobat Reader 9.x before 9.1 and 8.x.x before 8.1.4.
what a load , i've neer gottten a virus with adobe acrobat it's plain and simple , don't open "strange" pdf's only open pdf's from companies you know youc an trust (such as my schoolweb site and autodesk pdf's for 3ds max). reall to me anthing else is teh "strange". it's plain and simple go with choices you can trust
I'm not saying we should change for security reasons, I'm saying we should change because PDF sucks as a format, not to mention it's closed and proprietary, I don't feel I should have to pay money to save a document in the PDF format. SVG can do everything is can, and it can do it better.Althought, from a security stand point, Inkscape (the more prominent SVG editor) is much safer as it doesn't connect to the internet for any purpose. Not to mention SVGs are just XML documents that can be made by hand (if you were really paranoid about security).
pdf will not go away becuase it is what is still taught to many student's , I'm in school for game art design , and our school requires a lot of adobe software thier reader being one of those. it's all about industry familiarity compaiens like pdf . becasue it has such a large user base that knows pdf already . switchign would be time consuming adn costly to any company.
I'm use FoxitReader from more then two years ago
.... i found it very fast against Acrobat Reader ..
now after that i will never use Acrobat Reader for good ..
Another good (and free) alternative is PDF-XChange Viewer, which also has a shareware version (PDF-XChange viewer PRO) with some additional features
Oops, sorry, I've just checked again and it seems that the free version of PDF-XChange viewer has an Ad-Bar, so it's ad-ware not freeware. The shareware version obviously removes it.