14 ms·
50 CVEs in 50 Days: Fuzzing Adobe Reader
- agumonkey 8y agoWhat about having continuous fuzzing servers for just about any software ? kinda like virustotal.
- Someone1234 8y agoIf you're talking about the developer of the software? Potentially. As to third parties, this article goes into painstaking detail on how difficult it is to set up fuzzing for closed source binaries. You need to understand a certain amount of "rules" around each API call, and while you can duplicate their normal usage, there's a certain amount of thought that has to go into it.
- arkadiyt 8y agoGoogle does this with their oss-fuzz project (only for open source projects, since as Someone1234 noted it's very difficult otherwise): https://github.com/google/oss-fuzz https://github.com/google/oss-fuzz
- touisteur 8y agoMicrosoft had 'project Springfield' which became 'Microsoft Security Risk Detection' (https://www.microsoft.com/en-us/security-risk-detection/ https://www.microsoft.com/en-us/security-risk-detection/). Kind of like Fuzzing as a Service. Anyone on HN has any experience to report with this ?
- andrei-fuzzbuzz 8y agoWe've been working on something like this for the past couple of months and we'll be launching in early/mid January![0] We've got experience working on large scale fuzzing infrastructure (Chrome fuzzing team, Coinbase fuzzing), and have modelled it similarly to Google's oss-fuzz[1], but for private projects and clouds. We're always looking for companies and security researchers that want to fuzz but don't have the time/knowledge on how to do so (we automate a lot of the set up process and integrate nicely into your GitHub workflow) - drop me a line if you're interested - andrei@fuzzbuzz.io [0] - https://fuzzbuzz.io https://fuzzbuzz.io [1] - https://github.com/google/oss-fuzz https://github.com/google/oss-fuzz
- brian_herman 8y agoAwesome work!
- time-domain0 8y agoIf you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.
- AnaniasAnanas 8y agoI was under the impression that PDF was created as a response to postscript being "too programmable" and not "document enough" but then they decided that PDF is too minimal and so they ended up bloating it beyond what PostScript ever was by including JavaScript, Flash, and other trash in it.
- kibibu 8y agoIt's got a 3d model viewer in it
- ryacko 8y agoSo does TempleOS.
- kibibu 8y agoAre you suggesting we replace PDF with TempleOS?
- grawlinson 8y agoIt would be an improvement!
- fabricexpert 8y agoI'm waiting for someone to post a wasm templeOS build which has some been modified to open pdfs immediately
- 8y ago
- brabara 8y agoWonder how many of these were already in use by state actors?
- AnaniasAnanas 8y agoDo people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.
- mistrial9 8y ago.. tried Zathura on LUbuntu just now for the first time ; appears to be a VIM for documents viewing or something.. no interest in Zathura here!
- AnaniasAnanas 8y agoWhat do you use? I also had good experiences with Okular in the past but I have not tried it in ages. Before moving to zathura I used xpdf and evince but I was not satisfied by them (not to mention that they do not support postscript and djvu). Zathura does have some vim keybinds but other than that I can't see any similarities.
- kvakil 8y agoand just like that, you've convinced me to install it. Different strokes for different folks, I suppose. :)
- schoen 8y agoI was also convinced to install it, although after trying it, it looks more like less for PDFs than vim for PDFs (as many of the commands search or scroll in complex ways, but none of them modify the PDF). Still, it's interesting to have something like less for PDFs!
- jgtrosh 8y agoIMO mupdf is the real less for PDFs. It is so lightweight and straightforward it makes everything else seem terribly bloated.
- peteretep 8y agoI feel like if you’re a corporate buyer of Adobe software, you’ve got grounds for gross negligence here?
- rixrax 8y agoI recall listening to a presentation in RSAC around 2013 or 2014 where Adobe CISO or CIO or someone pretty much said that they don’t give fucks about product security. E.g. zero impact on sales. I suspect it was thrown in as a bit of trolling attempt in a conversation but looking at their track record maybe that is the reality.
- eganist 8y ago> they don’t give fucks about product security. More accurately stated as "we sandboxed it, so anything discovered is less likely to be critical." https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sandboxprotections.html https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sa... I've heard a variant of that talk delivered by a non-C-level at an appsec/prodsec-focused conference where the rehashed quote above (though I'm blatantly paraphrasing) was the justification used. Something more closely reflecting the truth might be "we can't realistically tackle the many security defects in Acrobat and Flash, so we sandboxed both applications instead to generally reduce the technical risks posed by any vulnerabilities in code."
- deleted 8y ago[deleted]
- devwastaken 8y agoIt's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.
- saagarjha 8y agoPDFs are supposed to look the same on every computer. Webpages can’t do that yet.
- devwastaken 8y agoI don't know how accurate that is for PDF's, but webpages are supposed to look the same, and given known compatible styling, it should be on any modern browser. Browsers are extremely consistent in content presentation, that's why webpages from early 2000s still look the same.
- deleted 8y ago[deleted]
- megous 8y agoNo. Take for example font-family: sans-serif. That can look like anything, can have different widths on different devices, etc. Browser windows can have any size, devices can have various pixel densities, users can work at different zoom levels, etc. The previous big thing was responsive design.
- arianvanp 8y agoSame counts for PDFs. If the font isn't shipped inside the bundle, the PDF will look like shit.
- megous 8y agoGood point. I noticed that too. At least web pages are made so that the content is re-flown [seems like the whole point], so it doesn't look like shit. It seems like [many?] PDFs place each character separately so if the actually used font is different from the one used during creation, the result will look very messy.
- crazy_monkey 8y agoLooks good! Microsoft should put Adobe Reader in the Windows kernel, where it belongs!
- fulafel 8y agoThe fact that companies still have the email-> employee pc -> acrobat reader pipeline enabled says a lot about what companies really think about security, posturing aside. (home users too, but they can plead ignorance)
- technion 8y agoAs much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has changed much. They've certainly managed to bolt on a whole lot of new features, but that can only make the position worse. As much as this sounds like a call to kill Adobe, something needs to happen before that's feasible. For the average enterprise, Adobe Reader is far more ingrained than these products were. Case in point, in organisation I asked the question of whether Chrome's PDF viewer would cut it for them. One large department then ordered Adobe Professional for every user. They told me they didn't need it, they just knew I wouldn't propose removing a product they'd actually paid for. Adobe Reader needs its HTML5 moment - an alternative that's not just "good enough for most people", but one that's actually better.
- oblio 8y agoWho's going to go into an entrenched, mature market? The money's going to the easy places, new markets.
- wongarsu 8y agoTo be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't there yet
- throwaway12iii 8y agopdf.js has had 26 pull requests merged in the last month. 5,622 additions and 6,991 deletions. That's just in the project directly, not in the dependencies. Since it's such a quickly evolving project, I wondered where form support is up to. https://github.com/mozilla/pdf.js/issues/7613 https://github.com/mozilla/pdf.js/issues/7613 Form support is not complete. Seems like it required quite a rewrite to get the foundation in a good place to finish it off. Are there rendering bugs? Yes. See plenty here: https://github.com/mozilla/pdf.js/issues https://github.com/mozilla/pdf.js/issues Of course, Acrobat also has PDF rendering bugs, and other various bugs apart from the security issues mentioned (their JavaScript implementation for example). As for printing... browsers aren't even good at printing HTML. The best browser for printing is based on the old Opera software(PrinceXML), and Safari is probably second. Remember the Apple display system used to be based on PDF rendering... and they do a lot with CUPS and graphic designers. However, printing PDFs on many browsers can go directly to the printer or the OS (which mostly all support rendering PDFs directly now).
- fghtr 8y agoIf you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.
- xytop 8y agoWhat the shit is there? Where is the most popular alternative, FoxitReader?
- consp 8y agoFoxit reader is closed source and the mentioned ones on that site are not. Addendum: Most links of the bottom row don't work anymore. Needs updates
- oblio 8y agoThat site is, in my opinion, hilariously bad for the non tech-user. Top row: Platform (what's that?): GNU (isn't that some kind of African animal?) Linux (oh, I know that one, it's the cute penguin!) The rest of the text in those boxes is mostly techno-babble for non-tech users (Gnome? KDE? DjVu?!??) I understand the intent behind it, but it would only serve a very small niche of users, who can already fend for themselves. Everyone else would go like: PDF? Ah, that's Adobe!
- Sahhaese 8y agoIs such a link even still neccessary? Edge, firefox and chrome have built in PDF readers. For more control sites can self-embed pdfjs so no external reader is required.
- joneser005 8y agoUnfortunately, yes it is. Just yesterday, my wife tried to open a pdf transcript from her college. It would not open on anything other that Adobe Reader on a traditional os, putting it out of reach for her, being an Android/Chromebook user. Neither Chrome nor Google Drive/Docs could open it. And I could only open it in Adobe Reader on my laptop - not Firefox, not Chrome, and not whatever default viewer my laptop has. We've had this problem with PDF's from another organization, too. It is a real problem.
- TeMPOraL 8y agoBeing able to run JS in a PDF sounds scary to a lot of people, but I wouldn't throw that idea out entirely. If you follow the work by Bret Victor & others on "explorable explanations"[0][1] and interactive scientific papers[2], you probably appreciate the need for a self-contained format for interactive documents. Could PDF be this? I don't know, I hear the spec is too scary. But I'd say we should have something like that. -- [0] - https://explorabl.es/ https://explorabl.es/ [1] - http://worrydream.com/ExplorableExplanations/ http://worrydream.com/ExplorableExplanations/ [2] - http://worrydream.com/ScientificCommunicationAsSequentialArt/ http://worrydream.com/ScientificCommunicationAsSequentialArt...
- jeeceebees 8y agoDistill[1] is another example of interactive scientific papers (with a focus on machine learning). But is there really a good reason to not just keep these in browser? I don't really know if there's much value in reading these locally. Maybe this would be a good fit for an electron app? [1] https://distill.pub/ https://distill.pub/
- TeMPOraL 8y ago<Insert the long list of arguments about Internet (especially _fast_ Internet) not being as ubiquitous as living in SV could make you think.> That behind us, there's also a matter of reliability and control. Services live much shorter than data they process; given today's trend, I wouldn't expect an online-only paper to be available after 5-10 years. Having a self-contained bundle would let me archive it independently, and would prevent any third parties from being able to interfere with my reading/exploration.
- lbriner 8y agoAcrobat Reader has been the poster boy for poor software for many years and it appears that Adobe have been good at adding new features to make it largely impossible for their competitors to keep up. What is one to do? Surely, the obvious answer is to ringfence PDF (or another new format) for the most basic features. These could more easily be handled by 3rd-party apps both securely and to render correctly. Let Adobe do whatever they want with their own format by adding loads of stuff people don't want, then the sell is harder for them: Get a cheaper, safer app for writing portable docs which can do most things or pay more money for a very insecure format that does stuff you don't need. I assume that others have attempted at some point to make an OSS alternative to PDF and I'm guessing it hasn't worked yet?
- tonyedgecombe 8y agoThat is sort of what PDF/A is: https://en.wikipedia.org/wiki/PDF/A https://en.wikipedia.org/wiki/PDF/A
- aisofteng 8y agoWhat a strange bar graph, where each column is color coded to a year rather than just putting the years on the x axis.
- herodotus 8y agoI may have missed something, but it looks to me like this is really a test of just the JPEG 2000 part of Acrobat Reader. It is possible that Adobe built this part of the reader by taking some open source implementation of JPEG 2000 (such as the reference implementation), and modding it - probably by changing memory allocation to be consistent with ARs memory model. So it is possible that some or many of the discovered vulnerabilities are in fact part of the JEPG 2000 library, in which case the problem goes beyond Adobe Acrobat.
- xvilka 8y agoSince KDE, GNOME, and FSF foundations recently got a significant contribution this year, I wonder why they wouldn't join forces and hire a couple full-time developers to make poppler and all poppler-based PDF viewers (Evince, Okular, etc) actually useful for PDF Forms, animated and interactive content.
- devy 8y agoHonest question: why can't Adobe hire product security engineers to do this kind of vulnerability discoveries or even hire 3rd party consultants to fix bugs/vulnerabilities before they even get into production? Every CVEs exposed by outside 3rd parties like this is a shame on their software quality and reputation, IMMO.
- Bhilai 8y agoThis is a great question and I have thought a bunch about it and the only conclusion I could make is that they dont care enough. This kind of news does not affect Adobe's stock price or their profits. Their users probably mostly don't care. So why bother paying $$$ for security engineers.
- devy 8y agoIf important zero-day affected by Adobe software causing rippling effects perhaps they will care more? At this quality and enough time, it probably is bound to happen.
- Shebanator 8y agoThis. I left Adobe in 2008 (involuntarily :-) ), and it boggles my mind that they haven't done this sort of fuzz testing and fixed the issues in the last 10+ years. Sure, putting the code in a sandbox covers a multitude of sins, but I don't think that is sufficient. Many other Adobe products use the same code to read/write PDF files, and AFAIK they don't do it in a sandbox.
- 1024core 8y agoOh no, not Adobe again! This company has been putting out shitty (in terms of security) for 20+ years. Anyone remember Adobe Flash? (shudder)
- mitchtbaum 8y agoAdobe's software is large enough and ingrained deep enough that it seems people give it a pass with today's standards for software stability. Lowering the threshold of well-shaped review nearer to git and libgit2 would yield even more value toward stepping through the software stargate. Git total loc: 279,993 libgit2 total loc: 219,887 Git CVEs (so far): https://www.cvedetails.com/vulnerability-list/vendor_id-4008/GIT.html https://www.cvedetails.com/vulnerability-list/vendor_id-4008... libgit2 CVEs (so far): https://www.cvedetails.com/vulnerability-list/vendor_id-16066/product_id-35762/Libgit2-Project-Libgit2.html https://www.cvedetails.com/vulnerability-list/vendor_id-1606...