Security Response

Adobe Systems released a security update for Adobe Acrobat and Reader 9.x for Windows on December 16, 2011, in order to fix a zero-day vulnerability. As Vikram Thakur reported recently, there have been zero-day attacks using this PDF vulnerability, dropping Backdoor.Sykipot on to the compromised computer.

We have found another variant of PDF malware in the wild using the same vulnerability. This version of PDF malware uses an encryption method that is found natively in the PDF specifications. As I wrote in my Portable Document Format Malware whitepaper, the encryption method used by PDF malware has changed...

Adobe has issued a public advisory regarding a critical vulnerability (CVE-2011-2462) that affects:

• Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh
• Adobe Acrobat X (10.1.1) and earlier versions for Windows and Macintosh
• Adobe Reader 9.4.6 and earlier
• 9.x versions for UNIX

This critical vulnerability has recently been seen exploited in the wild in targeted attack emails sent on November 1st and 5th. This attack leverages the zero-day vulnerability in order to infect target computers with Backdoor.Sykipot.

We have seen Backdoor.Sykipot used in targeted attacks since January, 2010 and this is...