Both Foxit Software and Adobe Systems are looking at ways of warning users about a new PDF attack threatening system security. Didier Stevens, an IT consultant with Contraste Europe, discovered the vulnerability, which entails getting PDF viewers to automatically execute embedded executables when the PDF file is opened.
"After receiving word of a recent security concern, the Foxit development team immediately looked into the issue, confirmed the risk and resolved the situation quickly," the company told eWEEK in a statement. "Foxit expects to release a new version of Foxit Reader with this fix on April 2, 2010.
"To address the specific problems outlined, Foxit has added a warning dialog box that will pop up when a PDF file is opened with Foxit Reader, asking the user to agree to execute or not," the company continued. "This solution adds a layer of safety yet maintains Foxit Reader’s compliance with current PDF standards."
Adobe already has a warning box in place, but Stevens claims there's a way for hackers to partially alter the dialog. According to eWEEK, Adobe is discussing the potential threat but didn't say if it would take any further precautions.
Soccer fans around the world are eagerly waiting for the 2010 FIFA World Cup to kick off. Soccer's marquee event will virtually transform host nation South Africa into the mecca for the sport's impassioned followers around the world. Like with any other major world event or cataclysm, the internet's dark alleys are filled with people ready to tax the outpouring of human emotion during the World Cup. It is likely that some of their nefarious plans are already afoot, even though there is a fair bit to go before the start of the event.
Symantec recently discovered a “targeted attack” that quite clearly tries to exploit the mounting soccer fever. Thankfully, the attack was thwarted before it could cause any damage. The attackers tried to drop their malicious payload using an email message ostensibly sent by a legitimate African Safari organiser, Greenlife. To the untrained eye, the sender had attached a “highly informative World Cup Travel Guide” with the message. But in reality the attached file was a modified variant of the real Greenlife's actual PDF guide. The actual PDF document was first debased with malicious code to exploit a recently patched vulnerability in Adobe Reader before being forwarded as an attachment.
“The patch for this critical rated vulnerability was released by Adobe on February 16, 2010. Since then we have observed a large number of targeted attacks attempting to exploit this vulnerability. Proof-of-Concept exploit code is available in the Internet which is contributing to the large number of observed attacks,” Daren Lewis, a Symantec employee wrote on the MessageLabs Intelligence blog.
Targeted attacks are known to be precise and less spammy. For instance, Symantec only has to deal with less than 100 such attacks every day, despite it blocking around 500,000 malicious emails per day. Such attacks usually target organizations, with people at the top of the pecking order more likely to be attacked first. This way the attackers can gain access to a pretty large chunk of that organization's sensitive information. In this case, the malicious email was sent to a person only identified as “a user in a major international organisation that brings together governments from all over the world.”
The HP Slate’s resemblance to Apple’s iPad looks to be no more than skin deep. Sure, the two devices do basically do the same thing, but Slate looks to offer a bit more potential, if the HP/Abode promotional videos are to believed, with Windows 7 and Flash support.
The tiff between Apple and Adobe raises some key concern about the quality of the Flash application. Sure, it drives a lot of content on the web, but at what cost to hardware? One, it appears, Apple doesn’t want to bear (and thus has hitched it’s wagon to HTML5). Adobe, understandably, doesn’t want to give up its content delivery hegemony on the Internet. Touting the amount of Flash content on the web, and demonstrating it can be used, and used without troublesome hardware consequences, is a good move to negate any bad public relations emerging from Apple’s very public stance.
Adobe may be stacking the deck in its presentation, however. According to Engadget, “Flash is said to be hardware-accelerated on the Slate, which suggests something other than a bone-stock Atom setup in there--we'd guess it's an Atom plus a Broadcom Crystal HD Accelerator”. How much of an impact this has is open to discussion, but it suggests that non-accelerated versions may move slower. Could Adobe’s approach later backfire, when users of other tablet devices don’t get this promised level of performance?
How well Apple’s Flash strategy plays out will be known shortly--if the iPad not just sells, but satisfies, then Apple made the right bet (for its customer base). We’ll have to wait and see later this year, when it is expected HP will release the Slate, whether Flash means all that much to consumers.
Earlier this week security researcher Aviv Raff warned of a potentially serious security bug in Adobe's Download Manager that could expose users to a zero-day attack. At the time, Adobe said it was aware of the issue and working on a patch.
Fast forward to today and Adobe has released a security update intended to plug up the security hole. The update affects certain users who downloaded Adobe Reader for Windows or Adobe Flash Player for Windows prior to February 23, 2010.
Adobe classifies this as a "critical" udpate and outlines steps above mentioned users can take to verify whether or not they are vulnerable. Two ways of doing that include:
Ensure that the C:\Program Files\NOS\folder and its contents ("NOS files") are not present on your system.
Click "Start">"Run" and type "services.msc." Ensure that "getPlus(R) Helper" is not present in the list of services.
If NOS files are found, Adobe recommends uninstalling the Download Manager via the Control panel. Alternately, users can delete "getPlus(R) Helper" from the list of services and then delete the C:\Program Files\NOS\folder and its contents.
Adobe has released the third beta version of Flash 10.1, and it comes with a nice treat for the early adopter on the move. Beta 3 finally adds GPU acceleration support for the Intel GMA 500 chipset. This is the graphics hardware found in the majority of netbooks. What does this mean in practical terms? Well, just 720p Flash video on a netbook, that’s all.
Over at Engadget they were able to coax a Dell Mini 10 to play back 1080p content as well. Both Youtube and CBS streaming appeared to work well enough with minor lag. Still, when any previous attempts to play this content brought a netbook to a grinding halt, you can’t be too picky.
The results are good for a beta. Sure, there’s still some jitter but it’s a vast improvement. Adobe has been racing to complete the update of the much maligned plug-in. The new beta gives us hope that the wait may be worth it. Get the beta 3 version of Flash right here and enjoy.
Adobe last week released a security update for a critical vulnerability in Adobe Flash, but according to security researcher Aviv Raff, installing the update could be cause for concern.
"If you did upgrade to the latest version of Flash from the Adobe website, you very likely have Adobe Download Manager installed," Raff points out.
So what's the big deal? Raff says there's an undisclosed flaw in the way Adobe's Download Manager works, which makes it possible for an "attacker [to] force an automatic download and installation of any executable he desires." In other words, those who download the update end up exposing themselves to a zero-day attack, Raff claims.
Adobe is apparently aware of the issue and is reportedly working with Raff to patch it up. The software maker also downplayed the security risk, saying "the user has to accept a number of prompts before being taken through the installation process," and therefore making it hard for a user to install unwanted and malicious software without their knowledge.
One of the bigger complaints with Apple's recently announced (and long hyped) iPad is that it doesn't support Flash, which some feel renders the $500+ tablet little more than a fashionable paperweight. That's not such a bad thing in Jobs' eyes, at least according to a report in Valleywag in which the feud between Apple and Adobe took a turn for the bitter.
As the story goes, Jobs shot down Adobe's Flash as little more than "a CPU hog" riddled with "security holes" and "old technology," so why bother including it in the iPad?
His alleged comments echo a similar sentiment shared during a shareholder meeting two years ago when Jobs explained why Flash wouldn't be integrated into the iPhone, saying the PC Flash version "performs too slow to be useful" and that Flash Lite "is not capable of being used with the Web."
Anyone think Apple and Adobe will eventually kiss and make up?
Today at Mobile World Congress Google showed off a new piece of software that may prevent untold thousands of cultural misunderstandings. The prototype software allows a user to upload a photo of text, and then translate it to a different language. In the demo, the application was used on a German menu where it correctly translated "Fruhlingssalat mit Wildkrautern" as "spring salad with wild herbs."
The app was running on an Android phone, but few details were released. It could be this is just some unreleased feature in Google Goggles. Google CEO Eric Schmidt played off the demo in his speech when he said the availability of cloud computing applications on phones would be a potent factor in the future of wireless technology.
The Google event also included a new look at Flash content working on the Android operating system. Between that and the image translation app, Google managed to work the Android fanboys into a frenzy. No word on release dates for either feature.
Adobe on Monday announced it has joined the LiMo foundation, an industry consortium "dedicated to creating the first truly open, hardware-independent" Linux OS for mobile devices.
The move will have Adobe bringing its Flash platform to the LiMo platform, enabling developers and content providers to create apps that can run on LiMo devices.
"Bringing the Flash platform to LiMo opens up a significant opportunity for Adobe to further its goals of open standards and multi-screen interoperability of rich mobile content," said David Wadhwani, general manger and vice president, Flash Platform Business at Adobe. "Following the goals of the Open Screen Project, the openness of Linux and the Flash platform represent a common vision to enable consumers to engage with rich Internet experiences seamlessly across any device, anywhere."
In addition to Adobe, the LiMo foundation said it also added ELSE Ltd. MobiTV, and SRS Labs to its ranks.
It's been nearly a week since I last reported about Apple's reluctance to allow its users access to the Flash platform. Apple--and Steve Jobs himself--have reportedly claimed that the instability of Flash was the driving factor behind Apple's ripping of this app straight off of its mobile devices (including the brand-new iPad) in favor of an HTML5-based solution for interactive content.
Although Adobe seemed to be letting Jobs' alleged tirade against Flash earlier this week go unanswered, ‘twas not meant to be. Adobe CTO Kevin Lynch has since responded in the company's official "Executive Perspectives" blog. I'm not much of a betting man (nightmares of CES losses haunt me to this day), but perhaps you are: Just which way do you think Lynch points the finger of blame for Flash's absence on--quote unquote--"a recent magical device."