Hacker News Reader

Comment by thursley | Hacker News Reader

More technical details (pdf) on: http://www.crysys.hu/skywiper/skywiper.pdf

Although the naming differs it has been noted on several blogs that it is the same malware.

I always hesitate a little bit when I open a pdf, specially when it is one on malware

Would opening a pdf via Chrome for example provide any extra protection? From what I understand most of the exploits are because of embedded media, no?

Extra protection as opposed to opening it in adobe reader, yes, much likely. Chrome has a sandbox for pdfs as far as I'm aware, they also provide a lot of big bug bounties to people who find any remote execution bugs in Chrome. So, in conclusion, yes, chrome provides relatively more security than other software when opening PDFs.

Even better would be firefox's javascript based pdf reader.

You can always open it inside a throwaway VM. I keep a couple ;-)

It depends: will you render it using Adobe's software?

IIRC, both Adobe Reader "Protected Mode"[1] and Chromium "sandbox"[2] are built on Windows user-mode sandbox framework[3]. Basically, things like principle of least privilege and disable writes etc.

[1]http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-pro...

[2]http://dev.chromium.org/developers/design-documents/sandbox

[3]http://blogs.msdn.com/b/david_leblanc/archive/2007/07/27/pra...

Security is all about execution: Chrome has an enviable track record; Adobe has an embarrassing one. They could change that but it's unclear that they're motivated to build up serious security competency (if they were, the manager in charge of their update process would be fired for cause)

Note that while the exploit is in the PDF, the vulnerability is in the PDF reader. In practice, Adobe's software is the only attack surface anyone ever exploits, so you can read exploit-laden PDFs worry-free by using a less popular alternative. The same is true with Word/Excel files, etc.

You should still have some kind of comprehensive security solution in place, particularly for a business environment, but use of non-standard software is an effective fail-safe for when your "real" security craps out on you (as it inevitably will).

I've no idea why everyone only exploits Adobe's software though. For instance, pretty much all the open source PDF readers are based on a single PDF library called Poppler with a history of security vulnerabilities - exploit that and you should be able exploit all of them in one fell swoop.

For what it's worth if you're using OSX Lion Preview is sandboxed.

Use chrome! It's probably more secure than downloading the PDF and opening it with Adobe software.

Adobe Reader X actually has a decent sandbox ... but you're generally correct, I would trust chrome more.

Wow, I take back my statement. I have more respect for Adobe now.

> sKyWIper may have been active for as long as five to eight years

spooky.

Reply on news.ycombinator.com