Security Response

Adobe Systems released a security update for Adobe Acrobat and Reader 9.x for Windows on December 16, 2011, in order to fix a zero-day vulnerability. As Vikram Thakur reported recently, there have been zero-day attacks using this PDF vulnerability, dropping Backdoor.Sykipot on to the compromised computer.

We have found another variant of PDF malware in the wild using the same vulnerability. This version of PDF malware uses an encryption method that is found natively in the PDF specifications. As I wrote in my Portable Document Format Malware whitepaper, the encryption method used by PDF malware has changed...

Adobe has issued a public advisory regarding a critical vulnerability (CVE-2011-2462) that affects:

• Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh
• Adobe Acrobat X (10.1.1) and earlier versions for Windows and Macintosh
• Adobe Reader 9.4.6 and earlier
• 9.x versions for UNIX

This critical vulnerability has recently been seen exploited in the wild in targeted attack emails sent on November 1st and 5th. This attack leverages the zero-day vulnerability in order to infect target computers with Backdoor.Sykipot.

We have seen Backdoor.Sykipot used in targeted attacks since January, 2010 and this is...

Last year I wrote a blog entry entitled The Fight Against Malicious PDFs Using the ASCII85Decode Filter, which is about a threat that uses the ASCII85Decode filter to hide itself. Since that time, some Adobe Reader vulnerabilities have been found, including a recent zero-day vulnerability. However, attackers like to use not only direct exploitation, but also social engineering. I think this is because patches can fix software vulnerabilities fairly easily, but social engineering requires us (as potential victims) to understand and know what is dangerous, which is never easy.

More recently, I have discovered a social engineering threat that uses a PDF file as a “container” file. This PDF threat contains a 7-Zip file as an attachment...

Symantec detected a major spam attack using the PDF vector on July 1, 2010. The attack comprises a crafty message asking the recipient to confirm his or her phone number in a PDF file attachment disguised as a phone bill. The payload within the PDF is a Trojan that is detected by Symantec as Trojan.Pidief.I, which exploits the Adobe Acrobat and Reader CVE-2010-0188 Unspecified Remote Code Execution vulnerability in order to drop additional malware on to the compromised computer.

Sample of the Trojan.Pidief.I attack

The attack lasted three hours and accounted for approximately 6% of all spam seen during that time, and it constituted approximately 1% of all spam seen on that day. Although PDF spam isn’t new, this is the...