Analysis: Why is Adobe Acrobat so insecure?

Acrobat used to be a simple application that replicated paper documents, but Adobe's efforts to update it have made it more insecure

Another day, another Adobe Acrobat security flaw. Or so it sometimes seems. The latest exploit, uncovered at the beginning of September, enables attackers to surreptitiously download malware to the user's PC in the background while he or she peruses a seemingly innocuous document.

And it isn't just users of the fully feature Adobe Acrobat Professional tool, which is used to create PDF documents, who are at risk, but users of the free Acrobat Reader software, which many people don't even regard as a risk.

After all, Acrobat Reader is largely used simply to peruse boring documents within a sandboxed environment - what on Earth could be insecure about it?

That, though, is what Acrobat used to be about. When Acrobat was first released in June 1993, it was all about providing an electronic version of a static document, which couldn't easily be edited by the recipient in the same way that a word processed document could, for example.

Back in those heady days, Adobe even charged $50 a pop for Acrobat Reader, only dropping the charge later when it realised that people wouldn't pay for such a mundane tool - but that getting it distributed on almost every PC in the world would make PDFs the de facto standard for distributing secure documents.

But the security of Acrobat was blown apart when Adobe made the decision to integrate Javascript into the package so that users could generate interactive forms, and even embed Flash animations in order to jazz up their documents.

Javascript flaws

According to Ronnie Tokazowski, a senior researcher at security software company PhishMe, ninety per cent of all the security flaws in Acrobat and Acrobat Reader can be attributed to flaws in its implementation of Javascript.

"Adobe Reader comes with a very rich language so that people can integrate Adobe Flash, Javascript, and macros in order to make feature-rich content. However, hackers are able to take advantage of this," Tokazowski told Computing.

In the latest attack, detailed by Tokazowski in a blog post on PhishMe's website, hackers have exploited Javascript flaws in Reader in order to cause the Vawtrack backdoor to be downloaded to the compromised user's PC. Vawtrack, notes Tokazowksi, is not widely recognised by anti-virus software and, therefore, might not be picked up even if the user's anti-virus software is up-to-date. This makes it particularly dangerous.

"As a security mechanism, I would recommend turning Javascript off in Adobe Reader," says Tokazowski. However, disabling Javascript in Reader may not be straightforward for many users - they will need to go to into the edit menu, then preferences, and then negotiate a long list of preferences before being able to disable it.

And, of course, disabling Javascript might also disable a number of features that users have grown to rely upon, which may inconvenience users in particularly at-risk environments, such as accounts departments doing regular banking payment runs, because they may also be generating or responding to interactive PDF forms.

These manifold, seemingly intractable security flaws haven't stopped Acrobat Reader from being probably the most widely used application in the world. And, even if the number of flaws uncovered in Acrobat Reader in 2014 are down on 2013, they are still extremely serious.

Indeed, according to CVE, the majority of flaws remain "code execution" errors, mostly related to Javascript, which enable attackers to bypass the sandbox protection mechanism and/or execute arbitrary code.

However, having taken the choice to load up Acrobat with Javascript and other features, Tokazowski believes that Adobe has little choice but to double down and work harder on eliminating the various security flaws in its code. Yet, Javascript presents inherent security problems.

"In my personal opinion, people can live without Javascript," he says.

Tokazowski isn't the first person to proffer such an opinion.

"Once again, Adobe has confirmed a gigantic security hole in their buggy, bloated, and completely insecure Adobe PDF Reader application. This isn't the first time, either - it's like a non-stop barrage of security holes from Adobe products," claimed one website.

That was in 2009 and, while it might seem that too little has changed, Adobe insists that it has radically beefed up its security teams.

"As a result of changes in the threat landscape, we have about seven times as many engineers dedicated to security today compared to 2009," claimed a company spokesperson.

"Adobe has a team in place (the Adobe Secure Software Engineering Team or ASSET), which is dedicated to ensuring our products are designed, engineered and validated using proper security techniques," she continued. "A second team within ASSET is responsible for responding to, and communicating about, security issues."

Product engineering teams now work hand-in-hand with security, she added, which ought to be reflected in a declining number of flaws being found this year and, hopefully, even fewer next year.