Comment by MiguelHudnandez | Hacker News Reader

Comment by MiguelHudnandez | Hacker News Reader

Parent Full thread

MiguelHudnandez

I apologize -- I should have cited recent events as the reason I brought up Adobe specifically. I did think I worded it in a way that made it clear I was speculating, but I see now I should have been much more specific.

Yesterday Adobe released a very serious advisory for Flash Player: http://blogs.adobe.com/psirt/2011/03/security-advisory-for-a... http://news.ycombinator.com/item?id=2328928

And I was thinking of the highest-profile hacking case I can remember, when Google was infiltrated primarily by vulnerabilities in Adobe software. If I recall correctly, maliciously crafted PDFs were e-mailed to staff with cleverly engineered "From" addresses and subjects. For example, an employee received an e-mail from their boss's e-mail address.

the context may not be right, but you do have a point. flash and acrobat are the easiest attack vector, as it seems that for years now they have almost constantly been vulnerable to one exploit or another, upgrading them is a PITA for users, and they are often easy to exploit

for years now, whatever computer I have myself, or whenever I am setting a network policy (if the owner agrees), I always always disable flash and acrobat/pdf readr.

Operation Aurora was an Internet Explorer vulnerability, not an Adobe vulnerability.

It was both.

If you read the various news reports closely, you'll see one vector was the 0-day IE vulnerability, another was malicious payloads in PDFs.

The headlines haven't helped.

http://www.computerworld.com/s/article/9144844/Hackers_used_...

"Hackers exploited an unpatched vulnerability in Microsoft's Internet Explorer (IE) browser to break into some of the firms targeted in a widespread attack that compromised Google's and Adobe's corporate networks"

"Google and Adobe, the only two companies to have stepped forward thus far to acknowledge the attacks, were hacked using malicious PDF files that exploited a zero-day vulnerability in Adobe's popular Reader software"

Reply on news.ycombinator.com