Members
  • Total Members: 12816
  • Latest: t114563
Stats
  • Total Posts: 28525
  • Total Topics: 8240
  • Online Today: 823
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Microsoft Urged to Secure Windows with Built-in PDF Viewer (save as PDF)  (Read 2789 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


Microsoft should add a basic PDF viewer to Windows to help protect users from the spike in attacks exploiting bugs in Adobe's Reader, a security researcher said Friday.

"Apple does this with its Preview [application], and Microsoft should, too," said Sean Sullivan, a security advisor with Finnish antivirus vendor F-Secure's North American operation. "I just want to view and read PDFs. I don't want to listen to them or watch them or launch executables from them or run JavaScript," Sullivan added, referring to several advanced features that Abobe's own PDF viewer, the for-free Reader, supports.

Some of those features, including Reader's support of JavaScript and the PDF specification's support for the /Launch function, have been exploited by attackers in increasing numbers since 2008. According to tallies by antivirus vendor McAfee, PDF exploits were up more than eight times in 2009 compared to the year before, a trend that has continued into 2010.

And the /Launch function, which allows PDF documents to run embedded executable files, is currently being exploited by attackers in a widespread malicious message campaign that tries to trick users into opening a rigged PDF.

Sullivan spelled out his case in more detail in a post to the F-Secure security blog on Thursday. "Your customers are tired of the exploits and the complications that so many of today's PDF readers include," said Sullivan in a "Dear Microsoft" missive: http://www.f-secure.com/weblog/archives/00001943.html

"They should write a really simplified viewer, one that just previews PDF," Sullivan added Friday in a telephone interview. "They don't even need to build it into the operating system. They can make it an optional download like they did the 'Save As PDF' add-in for Office."

Although Microsoft intended to add support for saving documents in the PDF file format to Office 2007, it was forced to backtrack when Adobe balked. Instead, Microsoft built a "Save as PDF" add-on that it made available free of charge. After Adobe submitted the PDF/A specification to the ISO (International Organization for Standardization) in 2008, Microsoft added "Save As PDF" support to its suite with the release of Office 2007 Service Pack 2 (SP2) a year ago. The same feature is available in Office 2010.

Office cannot open PDF documents without third-party software or add-ons, however. Windows 7 's and Windows Vista's preview feature also won't display PDFs. Instead, Microsoft has promoted, with little success, a substitute for PDF dubbed XPS (XML Paper Specification); an XPS viewer is bundled with Windows 7, for example.

"The PDF specification has been completely royalty-free since 2006," said Sullivan, noting that Microsoft would not have to pay Adobe if it did craft a viewer of its own. "There's no reason why it can't create a native PDF viewer. It could even let users toggle it on and off, if it [were] worried about antitrust [issues]."

Several times, Sullivan compared his vision of a Windows PDF viewer to Preview, the application that Apple includes with Mac OS X. But Preview is not bug free: In March, researcher Charlie Miller said he'd found more than 60 PDF files on the Web that could be used to crash and likely exploit Preview .

Even so, Sullivan argued that Microsoft, or failing that, Adobe itself, should develop a stripped-down PDF viewer that omitted the functionality and features hackers have exploited. "I wish Adobe would create two different versions of Reader, one maybe 'Reader Lite' that's really just a viewer," he said.

(PCW)

Samker's Computer Forum - SCforum.info





Brian

  • SCF Member
  • **
  • Posts: 15
  • KARMA: 6
  • Gender: Male
  • We live in a digital world!
    • TechAirlines
I'm mostly using Foxit Reader now, although my main issue is the fact it still freezes non-IE browsers.

A Reader Lite would be nice (something like Sumatra PDF). I rarely use the other features, if at all.
Best regards,
Brian

TechAirlines - Journey into the World of Technology

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
I'm mostly using Foxit Reader now, although my main issue is the fact it still freezes non-IE browsers.

A Reader Lite would be nice (something like Sumatra PDF). I rarely use the other features, if at all.


I think that most of this readers are also vulnerable to same exploits?


haz

  • SCF Advanced Member
  • ***
  • Posts: 117
  • KARMA: 26
  • Gender: Male
Linux too has its own PDF viewrs, There is the Adobe reader as well, but I prefer the lightweight open source alternative..
If you just needed a viewer with minimal functionalities and better security & speed for windows try "sumatra pdf" viewer, excellent tool :)
http://blog.kowalczyk.info/software/sumatrapdf/index.html

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Linux too has its own PDF viewrs, There is the Adobe reader as well, but I prefer the lightweight open source alternative..
If you just needed a viewer with minimal functionalities and better security & speed for windows try "sumatra pdf" viewer, excellent tool :)
http://blog.kowalczyk.info/software/sumatrapdf/index.html

Thanks for tip, Haz.  :up:


basant.ece

  • SCF Member
  • **
  • Posts: 59
  • KARMA: 7
save as to pdf formate in microsoft office has really make very comfortable in using this pdf...........

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising