Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Clicking on a PDF in your email in-box can be lead to series of security headaches. Lisa Phifer provides tips to protect yourself from PDF-based malware.
In early 2010, PDF exploits were by far the most common malware tactic, representing more than 47 percent of all Q1 infections tracked by Kaspersky Labs. By mid-year, PDF exploits had fallen to 30 percent, overtaken by Java. However, PDF remains the world’s second most popular target.
For those running PDF software – lead by Adobe Reader and its commercial counterpart Acrobat – these attacks have triggered a seemingly nonstop stream of updates. Why do malware writers love to exploit PDF and how you can avoid becoming a casualty of this on-going arms race?
Low-hanging fruit: One of the biggest reasons that PDF exploits blossomed in 2009 was Adobe Reader’s ubiquity. According to Kaspersky researcher Roul Schouwenberg, hardening techniques like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) had been rolled into Windows, making OS exploits less attractive. Malware writers searching for more fertile fields seized upon PDF as a wildly popular monoculture ripe for attack. Just about every desktop has a PDF reader installed — usually Adobe Reader or Acrobat. This enormous pool of potential victims translates into a financially lucrative attack target worthy of investment in malware development.
Push-button exploits: In reality, as malware kits that exploited PDF vulnerabilities became readily available, little effort or expense was actually needed to tap this opportunity. According to M86 Security Labs, malware kits such as LuckySploit, CrimePack, and Fragus can be purchased for as little as $100 — and commonly top out around $1,000. This trend started with MPack but really ramped up in 2008; today, most new malware kits include Adobe Flash, Java classes and PDF-based exploits. Those kits made it trivial to create obfuscated automated attacks that leveraged Adobe Reader’s many well-known code vulnerabilities.
Read the rest about guarding your PC against PDF malware at eSecurityPlanet.
