Hacker News Reader

Comment by LiquidSummer | Hacker News Reader

I always hesitate a little bit when I open a pdf, specially when it is one on malware

Note that while the exploit is in the PDF, the vulnerability is in the PDF reader. In practice, Adobe's software is the only attack surface anyone ever exploits, so you can read exploit-laden PDFs worry-free by using a less popular alternative. The same is true with Word/Excel files, etc.

You should still have some kind of comprehensive security solution in place, particularly for a business environment, but use of non-standard software is an effective fail-safe for when your "real" security craps out on you (as it inevitably will).

I've no idea why everyone only exploits Adobe's software though. For instance, pretty much all the open source PDF readers are based on a single PDF library called Poppler with a history of security vulnerabilities - exploit that and you should be able exploit all of them in one fell swoop.

Would opening a pdf via Chrome for example provide any extra protection? From what I understand most of the exploits are because of embedded media, no?

Extra protection as opposed to opening it in adobe reader, yes, much likely. Chrome has a sandbox for pdfs as far as I'm aware, they also provide a lot of big bug bounties to people who find any remote execution bugs in Chrome. So, in conclusion, yes, chrome provides relatively more security than other software when opening PDFs.

Even better would be firefox's javascript based pdf reader.

You can always open it inside a throwaway VM. I keep a couple ;-)

It depends: will you render it using Adobe's software?

IIRC, both Adobe Reader "Protected Mode"[1] and Chromium "sandbox"[2] are built on Windows user-mode sandbox framework[3]. Basically, things like principle of least privilege and disable writes etc.

[1]http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-pro...

[2]http://dev.chromium.org/developers/design-documents/sandbox

[3]http://blogs.msdn.com/b/david_leblanc/archive/2007/07/27/pra...

Security is all about execution: Chrome has an enviable track record; Adobe has an embarrassing one. They could change that but it's unclear that they're motivated to build up serious security competency (if they were, the manager in charge of their update process would be fired for cause)

Use chrome! It's probably more secure than downloading the PDF and opening it with Adobe software.

Adobe Reader X actually has a decent sandbox ... but you're generally correct, I would trust chrome more.

Wow, I take back my statement. I have more respect for Adobe now.

For what it's worth if you're using OSX Lion Preview is sandboxed.

Reply on news.ycombinator.com