Leaking sandbox?

Everyone’s favorite exploitation target, Adobe, seemed to have made some big strides with its newer versions of their Reader software. They implemented sandboxing, which theoretically restricts the program’s access to only the resources it requires.

I say “theoretically” as it seems to have been broken

I’ve said it before, but if you just need basic PDF reading functionality, don’t use Adobe Reader. There are lots of other options, and It’s far too big a target. And there’s always a new hole found.

It’s fun to pick on Adobe for poor security, but in their defense, the two widely exploited products (Reader and Flash) that they own are:

  1. very popular
  2. and…

  3. the types of programs that are most difficult to secure

Any application that processes large files that can contain a wide range of data is highly susceptible to exploitation. It’s difficult to secure a program when you have to accept and load such a variety of inputs.

To paraphrase Chris Rock: “Adobe, I’m not saying you shouldn’t secure your programs….but I understand.”


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s