New PDF Exploit May Be First Of Many In The New Year, Experts Say

Adobe will be a chief target for hackers and cybercriminals in 2010, researchers predict

Tim Wilson, Editor in Chief, Dark Reading, Contributor

January 5, 2010

2 Min Read

A sophisticated, two-phase attack that hides in PDF documents could be the first in a long line of exploits that target vulnerabilities in Adobe applications, researchers said this week.

In a blog posted earlier this week, Internet Storm Center researcher Bohan Zdrnja describes a new JavaScript exploit that hides in PDF files and exploits a known vulnerability.

The shellcode used for the exploit is remarkable in its small footprint and sophistication, Zdrnja reports. Just 38 bytes long, it works in two stages: The first stage seeks out targets and obfuscates the attack, then passes the baton to a second-stage shellcode that is capable of executing code on a victim's machine.

The exploit's construction makes it not only difficult for traditional antivirus tools to detect, but also masks the execution of the code so that the end user might not even know anything has happened, Zdrnja says.

"Not only was this a very interesting example of a malicious PDF document carrying a sophisticated 'warhead,' but it also showed the length attackers are willing to go to in order to make their malware as hard to detect as possible, not only for the AV vendors, but also for victims," the blog says. "If we are to judge the new year by sophistication the attackers started using, it does not look too good."

The new exploit feeds the fire of predictions that Adobe, not Microsoft, will be attackers' chief target in the new year. In its new threat predictions report, security firm McAfee projects there will be more attacks on Adobe in 2010 than on Windows.

Adobe Reader and Flash are two of the most widely deployed applications in the world, and many vulnerabilities already have been discovered and patched in these applications, McAfee observes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Tim Wilson, Editor in Chief, Dark Reading


Tim Wilson is Editor in Chief and co-founder of Dark, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights