Windows is an attractive platform for the malware writers, in part, because of the sheer number of users. As Microsoft creep towards making their offerings more secure, applications are increasingly becoming the focus for vulnerability exploitation.
Like Windows, Adobe products are a default software choice for most users. The bad guys know this and realize that its profitable to scrutinize their applications for exploitable vulnerabilities and create malware to take advantage of the fact.
Adobe have published a security advisory for a critical vulnerability affecting Adobe Shockwave Player 11.5.8.612 and earlier. So far there have been no reports of malware capitalizing on the vulnerability while Adobe work on a fix.
The ubiquitous Adobe Reader has also had its fair share of problems, judging by the fairly long list of security advisories and updates.
In an effort to contain malicious PDFs, Adobe have previewed Adobe Reader X. I’m looking forward to checking out the protected mode where Adobe Reader is fenced off from the operating system so that even if a malicious PDF is launched, its unable to “reach” the operating system to make changes to it.
This is a fairly realistic and pragmatic approach from Adobe to addressing the problem of malware that exploits vulnerabilities within Reader. Adobe accept their applications will continue to be a target for malware writers and are doing something interesting and, from the user’s perspective, innovative about it.
However, if an application is on the malware writers’ radar, there could be another way to handle the problem. Many computer users are aware of the volume of malware that affects Windows and have made the switch to alternative more secure, but also less popular operating systems to try to minimize the likelihood of being the victim of a malware attack. If the majority of malware attacks focus on Windows, for some, it’s a no-brainer to make the switch to an alternative like Ubuntu or Mac OSX.
The same approach can be applied to the applications on your Windows PC. There are alternative PDF viewers to Adobe Reader in the form of open source, non-ad supported and free applications – here’s a list.
A final word of advice: whatever PDF viewer you use, check its help file to see how to disable JavaScript
Taken from ‘Lavasoft Blog’