Attacks/Breaches
10/4/2013
09:04 AM
Connect Directly
RSS
E-Mail
50%
50%

Adobe Customer Security Compromised: 7 Facts

Could stolen ColdFusion and Acrobat source code spawn a new generation of zero-day attacks?

4. Criminals Could Find New, Exploitable Vulnerabilities

Beyond the customer data theft worries, the theft of source code is also cause for concern, because code-savvy attackers -- or anyone else who subsequently obtains a copy of the code -- might be able to study the code and find previously undetected flaws.

"While we are not aware of specific use of data from the source code, we fear that disclosure of encryption algorithms, other security schemes and software vulnerabilities can be used to bypass protections for individual and corporate data," said Hold Security's Holden. "Effectively, this breach may have opened a gateway for new generation of viruses, malware and exploits."

"It should go without saying that no software company ever wants to have criminals steal its source code -- it is, after all, the technology company equivalent of losing the Crown Jewels," said Graham Cluley, an independent security researcher, in a blog post.

5. Adobe To Enterprises: Lock Down Acrobat, ColdFusion

To date, Adobe said that it's seen no new attacks against products for which the source code was stolen. "We are not aware of any zero-day exploits targeting any Adobe products," said Adobe CSO Arkin. Regardless, he recommended that all businesses only run supported versions of the software, apply all security updates, and follow in full the security advice detailed in the Acrobat Enterprise Toolkit and the ColdFusion Lockdown Guide. "These steps are intended to help mitigate attacks targeting older, unpatched, or improperly configured deployments of Adobe products," he said.

6. Attackers Didn't Hack Into Adobe Using ColdFusion

After Adobe detailed the breach, questions quickly centered on ColdFusion, a rapid Web application development platform that was originally developed by Allaire -- as a way to connect HTML pages to databases -- and subsequently purchased by Adobe in 2005.

Did hackers exploit ColdFusion to gain access to Adobe? If so, that wouldn't be unusual. For example, the July 2013 breach at the Department of Energy that resulted in the theft of information relating to 53,000 past and current federal employees -- including dependents and contractors -- was traced to the agency using an outdated and unpatched version of ColdFusion.

But an Adobe official Friday dismissed that possibility. "The breach did not involve a CF vulnerability. Investigations are still happening to figure out the attack vector," tweeted Rakshith Naresh, Adobe's ColdFusion product manager.

7. Bug Hunters Downplay Source Code Value

What might the stolen source code be worth? "Adobe Acrobat source code valued at $500k to $30M on black market," tweeted attorney Jim Denaro at CipherLaw.

But some security experts have disputed at least the high end of that estimate, noting that the potential payoff to be gained from studying the source code to find new bugs that could be turned into working exploits -- aka "weaponized" and sold for a profit -- wouldn't be worth the initial investment.

"You can fuzz bugs cheaper, and you can audit cheaper. It's not so valuable," tweeted the Bangkok-based vulnerability broker known as the Grugq. "It is [definitely] worth more to Adobe than it is to anyone else."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
10/7/2013 | 11:26:45 PM
re: Adobe Customer Security Compromised: 7 Facts
Fair to say it's not a best practice to retain CC data any longer than necessary?
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
10/6/2013 | 2:38:11 PM
re: Adobe Customer Security Compromised: 7 Facts
This is exactly why we have a huge amount of regulations on the books. We basically have to force people/companies to do the right thing. Sad, really.
macker490
50%
50%
macker490,
User Rank: Ninja
10/6/2013 | 11:39:05 AM
re: Adobe Customer Security Compromised: 7 Facts
you would, --eh?
when you use your credit card you are authorizing the merchant unrestricted access to your account -- to the expiration date on your card.

everyplace you use it

PCI is based on pen and paper. proper authntication of digital transactions has never been incorporated into the system .
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
10/5/2013 | 1:17:09 PM
re: Adobe Customer Security Compromised: 7 Facts
I wonder why Adobe even held on to CC information. Throw it away once the transaction is done. Yes, the customer needs to key it in again the next time, but I rather type a few dozen characters than have my info stolen.
Do we really need to lobby lawmakers every single time to craft a law that enforces common sense?
WKash
50%
50%
WKash,
User Rank: Apprentice
10/5/2013 | 12:02:27 AM
re: Adobe Customer Security Compromised: 7 Facts
Scary that Adobe didn't spot this. And one more reason why never to reuse passwords .
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
10/4/2013 | 6:12:06 PM
re: Adobe Customer Security Compromised: 7 Facts
"But two different customers who received that email notification -- sent late Thursday, Pacific Time -- separately told InformationWeek that they'd initially dismissed the "important customer security alert" as spam."

The phishers are winning.
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
10/4/2013 | 5:28:17 PM
re: Adobe Customer Security Compromised: 7 Facts
Would the customer credit cards of past customers be at risk, or just people with some ongoing relationship like the newer subscription software options? I purchased a perpetual license to Creative Suite, but that was a couple of years ago, so I'd hope my credit card wouldn't still be stored anywhere.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2942
Published: 2014-09-22
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.

CVE-2014-5522
Published: 2014-09-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6025. Reason: This candidate is a reservation duplicate of CVE-2014-6025. Notes: All CVE users should reference CVE-2014-6025 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-5523
Published: 2014-09-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5524. Reason: This candidate is a duplicate of CVE-2014-5524. Notes: All CVE users should reference CVE-2014-5524 instead of this candidate. All references and descriptions in this candidate have been removed to prevent acciden...

CVE-2014-5575
Published: 2014-09-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVE-2014-5665
Published: 2014-09-22
The Mzone Login (aka com.mr384.MzoneLogin) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio