3 ms·

I apologize -- I should have cited recent events as the reason I brought up Adobe specifically. I did think I worded it in a way that made it clear I was specu

I apologize -- I should have cited recent events as the reason I brought up Adobe specifically. I did think I worded it in a way that made it clear I was speculating, but I see now I should have been much more specific. Yesterday Adobe released a very serious advisory for Flash Player: http://blogs.adobe.com/psirt/2011/03/security-advisory-for-adobe-flash-player-adobe-reader-and-acrobat-apsa11-01.html http://blogs.adobe.com/psirt/2011/03/security-advisory-for-a... http://news.ycombinator.com/item?id=2328928 http://news.ycombinator.com/item?id=2328928 And I was thinking of the highest-profile hacking case I can remember, when Google was infiltrated primarily by vulnerabilities in Adobe software. If I recall correctly, maliciously crafted PDFs were e-mailed to staff with cleverly engineered "From" addresses and subjects. For example, an employee received an e-mail from their boss's e-mail address.

sp_ 16y ago
Operation Aurora was an Internet Explorer vulnerability, not an Adobe vulnerability.
- nigelk 16y ago
  It was both. If you read the various news reports closely, you'll see one vector was the 0-day IE vulnerability, another was malicious payloads in PDFs. The headlines haven't helped. http://www.computerworld.com/s/article/9144844/Hackers_used_IE_zero_day_not_PDF_in_China_Google_attacks http://www.computerworld.com/s/article/9144844/Hackers_used_... "Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into some of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks" "Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software"
nikcub 16y ago
the context may not be right, but you do have a point. flash and acrobat are the easiest attack vector, as it seems that for years now they have almost constantly been vulnerable to one exploit or another, upgrading them is a PITA for users, and they are often easy to exploit for years now, whatever computer I have myself, or whenever I am setting a network policy (if the owner agrees), I always always disable flash and acrobat/pdf readr.

sp_ 16y ago

Operation Aurora was an Internet Explorer vulnerability, not an Adobe vulnerability.

nigelk 16y ago
It was both. If you read the various news reports closely, you'll see one vector was the 0-day IE vulnerability, another was malicious payloads in PDFs. The headlines haven't helped. http://www.computerworld.com/s/article/9144844/Hackers_used_IE_zero_day_not_PDF_in_China_Google_attacks http://www.computerworld.com/s/article/9144844/Hackers_used_... "Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into some of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks" "Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software"

nikcub 16y ago

the context may not be right, but you do have a point. flash and acrobat are the easiest attack vector, as it seems that for years now they have almost constantly been vulnerable to one exploit or another, upgrading them is a PITA for users, and they are often easy to exploit for years now, whatever computer I have myself, or whenever I am setting a network policy (if the owner agrees), I always always disable flash and acrobat/pdf readr.