Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
News

PDF Virus Spotted 244

Posted by michael from the xpdf-not-vulnerable dept.
Jethro73 writes: "Adobe's popular PDF file format [...] has generally been considered immune to viruses. But a new virus carried by programs embedded in PDF files raises concerns that the format itself could become susceptible. Read about it here and at coderz.net."
This discussion has been archived. No new comments can be posted.

PDF Virus Spotted More

PDF Virus Spotted

Comments Filter:
  • Seems to me that this is a very opportune time for an ethically motivated hacker to whip out a PDF virus, perhaps in protest to heavy handed lawsuits against Adobe!
  • Decrypt a ebook version of a very good selling book to .pdf put your typical subseven trojan in it and spread it on the net and you can go start DDoSing within days, thanks adobe....

    Damn i am lame.....
  • "There is no way for this to affect Acrobat Reader," said Adobe's Sarah Rosenbaum, director of Acrobat product management. "The code in Acrobat that recognizes attachments does not exist in Reader."

    So, when you pay for the enhanced version of Acrobat, you get infected. It should be the other way around... Adobe just doesn't understand business (as MicroSoft does).


    (Disclaimer: a bit of sense of irony and humor is required prior to moderating this post).
  • It states, clearly, that you need Acrobat, not Acrobat Reader to be at risk. Most people I know use Acrobat Reader, not Acrobat.

    But the way this story was posted, it sounds like every PDF you view has the capability to infect your computer.

  • This is just beautiful. One of the few file type you could trust under the MS platform is now compromised, by another VB programmer to boot.

    On the other hand, a few points are worth noting:

    • This is not dangerous, unless you use Adobe Acrobat, and not the reader.
      I use Acrobat, but under the Macintosh, so I am safe.
    • This is a Microsoft-only virus. If you run Adobe Acrobat Reader (or XPDF) under Linux or BSD, or something, you are probably safe.


    On the other hand: "[...] Adobe doesn't currently plan to prevent VBScript or other files from running."

    I say this is just another reason to boycott Adobe [boycottadobe.org]! It's just turning into another Microsoft.

    I also think the XPDF programmers should add security features to their (excellent) software, as well.

    Just my US$ 0.02...
    • But Adobe doesn't currently plan to prevent VBScript or other files from running.

      To prevent Peachy from being able to run, "the change we would have to make is not to allow VBScript attachments. That is a problem for a lot of our customers," she said. "If they change their opinion, we will do what they want."
      The reason Adobe isn't preventing vbscript to run it that thier customers WANT to run vb script. If they prevented VB scripts from running then thier customers would not be able to sue the product for what they want. Adobe says if customers want VB script blocked then they will block it. It's not like they are just saying "we don't care".

  • A PDF virus? (Score:3, Insightful)

    by Mr_Silver ( 213637 ) on Wednesday August 08, 2001 @10:07AM (#2114632)
    Unless i've read this totally wrongly, its not really a PDF virus - more a VB(S) virus embedded in a PDF file.

    If that is the case, then practically any program that can embedd other files is suddenly going to be flagged as having a virus, when in reality, its just the same old software (VB and VBS) causing the same old problems (reading outlook email addresses and so forth) ...

    Or am I missing something?

    • totally wrongly
      the grammer nazi would have a field day with you.

      a virus is (from www.whatis.com): A virus is a piece of programming code usually disguised as something else that causes some unexpected and usually undesirable event. A virus is often designed so that it is automatically spread to other computer users. Viruses can be transmitted as attachments to an e-mail note, as downloads, or be present on a diskette or CD.

      its just the same old software (VB and VBS) causing the same old problems
      dude, VisualBasic and VBScript are programming languages. Using your logic, you could have one hell of an argument against C or assembly language from the good ol' days. It just so happens that these programming languages allow relatively inexperienced coders to write some powerful stuff
    • Data formats (eg txt, doc, html, pdf) often embed files or scripts. The problem is when the script isn't sandboxed well and so it can do something you didn't think it could do: eg html scripts can read the contents of other html files in the same directory if they know the name of the html files, and doc macros / pdf embeds used to be able to do anything the user could do.
  • In other news today, Adobe announced the existence of the "Rotten" PDF virus.

    According to virus expers, the Rotten virus compromises the security of the PDF format by replacing each letter with one thirteen places from it in the alphabet.
  • This particular thing, as mentioned by many already, only affects Acrobat, not the Reader. I'd be more worried about this: http://www.kb.cert.org/vuls/id/31554 [cert.org], which has, of course, been patched by Adobe last November already.
  • Or Adobe will call the FBI up on yo ass!
  • "Adobe doesn't currently plan to prevent VBScript or other files from running"

    wow... That's the second company who'd rather have visual basic support then protection... and the first one owns a monopoly...

    I have to wonder how hard it would be... I mean, can't they at least have default support for that sort of embedded automated stuff turned off? That way, the huge majority of people who use Acrobat would have no problem, which would prevent the virus from spreading at a significant rate...

    Why don't they just turn support for embedded stuff off, by default, and have a simple switch/notification system to allow it to be easily reenabled?

    • "wow... That's the second company who'd rather have visual basic support then protection... and the first one owns a monopoly..."

      Adobe has a "monopoly" too, walled off by patents ... it's just that it's on PostScript and PDF so it isn't as noticeable. They're going to get more agressive defending it too.

      My other posts [slashdot.org] explain it all ;-)

  • Don't worry though th VB script uses ROT13 twice so that noone will notice that THIS IS JUST A SCRIPT. This is the exact same as most of the other virii going around. Just if you have adobe writer(not just reader which is all most people have) and you clik to execute a script within the document it can execute itself and spread. Yes this is kind of interesting but as far as worms go the number of people that are going to spread this is much less than the danger by one spread from acrobat reader.

  • What have those virus writers done NOW?

    "PDF Virus Spotted". Spotted? SPOTTED?!? What's next? Stripes? Or, shudder, PLAID?! :^)

  • And you can thank... (Score:5, Interesting)

    by dave-fu ( 86011 ) on Wednesday August 08, 2001 @09:57AM (#2117098) Homepage Journal
    ...feature creep. What does anyone need Javascript or anything "dynamic" in a PDF for, anyhow?
    When people start applying the KISS principle judiciously, things will get a whole lot safer.

    • Re:And you can thank... (Score:5, Insightful)

      by LetterJ ( 3524 ) <j@wynia.org> on Wednesday August 08, 2001 @10:42AM (#2127807) Homepage
      Why Javascript in PDF? Ever pay taxes? Javascript in PDF works well for forms that have to be printed and mailed, but they'd prefer typed entries to handwritten. It lets you do those inane calculations on the boxes on the US 1040 form and carry data to other fields. It lets you only enter the necessary data and eliminates mistakes based on simple math. Also useful for forms that want things like your name on the top of pages 2-99. Fill in your name on page 1 and it carries through. Want to have an online version of your form and want no legal problems by having two versions of the same form? Put the PDF of the print form on with Javascript validation. Just because you don't have a need for a feature in PDF doesn't mean that it wasn't necessary or isn't useful to someone.

      • Re:And you can thank... (Score:5, Interesting)

        by SCHecklerX ( 229973 ) <greg@gksnetworks.com> on Wednesday August 08, 2001 @11:32AM (#2148745) Homepage
        It lets you do those inane calculations on the boxes on the US 1040 form and carry data to other fields. It lets you only enter the necessary data and eliminates mistakes based on simple math. Also useful for forms that want things like your name on the top of pages 2-99. Fill in your name on page 1 and it carries through. Want to have an online version of your form and want no legal problems by having two versions of the same form? Put the PDF of the print form on with Javascript validation.

        And all of those things could be achieved with an online form, processed and verified on the backend that the administrators have *FULL* control over. Have you ever written a javascript 'application?' Did you know that the '+' symbol is used for both string concatanation and for addition? And usually, javascript will pick the wrong operation : 2+2='22', for example. Yeah, that's how I want my tax information calculated, NOT!

        This is almost the same shit I just had to go through with Pennsylvania's braindead online unemployment comensation registration. They did EVERYTHING as a FSCKING javascript/ActiveX client side app. UGH! It is so broken that I ended up just downloading a text form from the web site and faxing that in.

        Can someone please explain to me why anybody, ESPECIALLY A GOVERNMENT AGENCY, would write things so heavily dependent on client-side tools?

        Below is the letter I wrote to them:

        ...doesn't work at all under Netscape, Mozilla, Lynx, Links, KFM or Konqueror on linux.

        I did not test Netscape or Mozilla under Windows or Macintosh, but the problems could be there as well.

        In IE under windows, it caused a GPF 3/4 of the way through, and in several instances did not load properly, not allowing me to fill out fields that were required. Also in IE, your code causes a security alert on *EVERY PAGE* when using Microsoft's default security settings.

        WHY are you depending on so much client side code for what amounts to nothing more than a series of forms that are used to feed a back end database? There is NO EXCUSE for a GOVERNMENT AGENCY to be excluding all types of people (including the blind, or the poor who could be accessing your page from a text-only, no javascript browser) from filing for UC Benefits online. It is simply unacceptable.

        I am very disappointed in what you have slapped together to file claims online, and hope that you fix it for future unemployed folks who would like to file their claims themselves online, saving everyone time and effort.

        Yes, simple javascript can save some time by providing immediate feedback for data verification to the end user...but you depend far too heavily on it. What about people who are using browsers with no javascript enabled at all? They cannot file online. This also breaks a very basic security rule: You can't trust things coming from a client. ALL DATA should be verified on the backend itself.

        Since your application is totally useless for me, I decided to use a fax fill out form instead (linked on the same page as the electronic application). Well, it's a week later, and I haven't heard anything, so I called the Lancaster Unemployment Office. The representative there informed me that the preferred method is to file over the telephone, as faxes "can get lost, or sit on someone's desk for a week before being processed." Lovely. Why is the preferred (telephone) method not stated on the web page?

        Please re-write the online application. It can be a great tool to file online, but the way it has been done is error-prone and excludes a rather large set of people from using it. These people are then forced to use other methods, causing the entire system to be much less efficient.

        • Re:And you can thank... (Score:3, Informative)

          by LetterJ ( 3524 )
          Many, many forms, both in government and business require that the exact layout be used on all copies. The layout is chosen to meet accessibility regulations, etc. That part is non-negotiable. So, these forms traditionally are printed out and available by mail, or in person. Then Adobe comes up with PDF. This electronic file that retains the exact printed layout and can be downloaded or placed on CD-ROM. So, some agencies start using it. Folks download the file, print it out and send it in. Ahh, but some of those folks filling it out have incredibly illegible handwriting. Adobe, will you please make it so our forms can be filled out with typewritten information by our users before they print it? Sure. Adobe Acrobat forms are born. Then the agencies start to notice that when the form requires the same information in several different places, people are mistyping it in one or more. Hence the Javascript in PDF.

          Throughout all of this, the data is NEVER sent to any server at all. The agency is still requiring a printed copy of the filled out form. Keep in mind that in many cases, these forms are published by a government agency to be submitted to folks other than the agency itself. Prime example: the US W-4 form for income tax deductions from a paycheck. The form is submitted to the employer. The IRS makes up the PDF form and you fill it out and give it to your employer. The IRS isn't involved other than providing the proper form.

          As far as having built a Javascript 'application', yes I have. Not relevant to the discussion. The original post attacked not the implementation, but the very idea of Javascript in PDF. Your attack on Javascript has to do with a poor implementation in Javascript. I don't care what scripting language is used, the concept is valid and that's what I was defending.

          Improper implementations of a concept do NOT invalidate the concept itself. The concept must be evaluated on it's own merits.

          • Adobe, will you please make it so our forms can be filled out with typewritten information by our users before they print it? Sure. Adobe Acrobat forms are born. Then the agencies start to notice that when the form requires the same information in several different places, people are mistyping it in one or more. Hence the Javascript in PDF.

            That's all relevent, and I would stop just short of calling it a feature creep.

            But, on the other hand, on a government webpage, the mandate of which being to bring make government services more accessible, shouldn't they stay with simpler, more reliable, and better supported mechanisms?

            Maybe I'm unclear, but how does Acrobat get the information back to the PA gov't? Do you *fax* the form back, meaning that the unemployed dude has to have both a fax and a computer (or at least a computer and a scanner)? Remember, unemployment services will have a broad sector of people using it - not all of 'em will be computer geeks who have a scanner/fax handy.

            The other option: does Acrobat have the mechanisms to send the information back to the server? Is it encrypted? That'd be fairly personal information to be going across the wire.

            Acrobat isn't supported in a default Windows install. And, let's face facts, the lowest common denominator is AOL on Windows 95. While my mother has a real dial-up connection, she's at brower and e-mail only sophistication. She called me because someone sent her a PDF file, and had no idea what it was. I led her through downloading Acrobat Reader, but she got so frightened by all the installation options that she gave up, despite me telling her, "Mom, just click OK".

            The only thing I can think of to provide that level of functionality would be a good old HTML form. IE 2.0, which shipped with NT 4.0, supports it. The biggest hurdle is at least 56 bit encryption - what generation of browser started to include that by default?

            Bells and whistles are good, when they work. But, again, the cross-section of users *who are paying to use this service* (after all, it's *their* tax money) should be able to make use of it. Truck Driver Joe might not know anything outside of his small, clearly-defined AOL prison cell.

        • ...it's very dark.

          But seriously, here's my diatribe on government internet projects (from the trenches).

          The main reason that government on-line projects suck is because they want to deliver their services on-line and they don't have the in-house talent to make it so. (How many webmasters YOU think are in the building department of a medium-sized city? The answer is: ZERO)

          So, the well-intentioned civil servants hire computer consultants. Sometimes the consultants are teen-aged webmasters that work for peanuts and they positively rock! But sometimes governments hire consultants. Usually these projects have high ideals but are woefully underfunded. This means that the consultants, in order to come under budget, don't have time to effectively review the problem domain.

          Do we know where this is going? Yep:

          • Lack of requirements analysis
          • Scope creep
          • Consultant tries to make the client happy, but forgets about the real 'customer' (the end user).
          • Use of chrome to dazzle the unsophisticated client
          • Delivery of weak goods

          If the consultant is particularly unethical they will say (after the project is out of cash) that they're just working on a 'prototype' and that more money would be needed in order to deliver what was originally promised.

          In a climate like that, it's a miracle that any of these Government projects get completed. Sometimes the client falls for it... Repeat until sickened... diatribe off...

        • The Pennsulvania Unemployement Compensation Registration worked fine for me, back in April. It sounds to me like maybe you were just a little stressed out about losing your job and had a little misplaced aggression.

      • Re:And you can thank... (Score:2, Insightful)

        by Anonymous Coward
        Validation could be done by using passive methods, although format would need to have support for that. However... PDF was not designed to be interactive application. Why SHOULD people be able to "fill in" a PDF-document? The idea was to have a print oriented document format, so print the damn thing out, fill it in and send.

        Really, leaving back doors (ability to run scripts) to allow doing things creators didn't know/have time to implement is a very very VERY bad idea.

        Alternatively, if you really think it isn't all that bad idea (which, by the by is bad idea in itself), then at least make the scripts run in a sandbox a la Java's applet sandbox. Let them be able to modify document structure, but not modify local file systems (for example).

        (posting as on AC since writing from a public terminal)

      • That's amazing. (Score:4, Funny)

        by dave-fu ( 86011 ) on Wednesday August 08, 2001 @11:15AM (#2150686) Homepage Journal
        It sounds like you just described a web page to me.
        Also, it's high time that PDFs came with their own e-mail client so I don't have to go through the pesky details of saving and attaching and that horrible rigamarole. And a web browser so I can go fact-check or check m-w.com before I'm done.
        I demand these features in PDF. Just because no one needs them and other applications already do them doesn't mean they shouldn't put them in... right?

    • Electronic Workflow.

      Dynamic PDF stuff is *necessary* for those of us writing workflow applications in industried (e.g. financial services, insurance) where the complexity of forms requires lots of dynamic calculation and database interaction and the regulatory requirements all but make sure we cannot deviate from existing paper forms design. Plus, eventually we must produce documents for customers to sign, and to be archived, and to be audited, so PDF is the best choice.

      Yes, for many industries the JS/ODBC stuff is unnecessary (and, if you'll notice, this bug only affects those with full acrobat, not acrobat reader), but for others it's critical.

      • Dynamic PDF stuff is *necessary* for those of us writing workflow applications...

        Buzzzzzzzzzz! WRONG ANSWER.

        Before you reflexively hit the "reply" button, consider that I implemented just this sort of complex form application with lots of dynamic calculation and database interaction, and I don't get even CLOSE to PDF until it's time for the user to print the document...then my web site sends the PDF document (sans attachments, active scripting, whatever) to the Web browser for printing.

        Isn't Excel usually the choice for this sort of thing?

    • Acrobat lets people embed different file types within a PDF, including everything from the VBScript programs--used in the LoveLetter virus--to an actual executable program, Gullotto said.

      Peachy is named after a small game in a PDF file that involves finding peaches, Gullotto said. According to a person called Zulu, who said he wrote Peachy, showing the solution to the game runs a VBScript file.

      Yes, this is another VBS exploit, and java does not desrve your FUD. New features have their place, VB and VBS don't.

  • Look at the ingredients needed to make this work, Microsoft OS, Microsoft VBScript, Microsoft Outlook.

    All it takes is to run vbscript in a sandbox!!! Don't divert the blame for this thing from the root cause.

  • Actually, this feature in Acrobat began as a plug-in back in version 3, and was integrated into the full package with v 4. It's extremely useful with prepress workflow and asset management. What it allows us to do is:
    1. have an immediately viewable, printable representation of any archived document, accessible to whoever we want it to be over the web, and
    2. have almost instant access to the native application files that created the document, in case a file must be modified or updated. Like the Pagemaker file, graphic images and fonts.
    The feature really functions not much differently than, say, using WinZip to compress files into an self-extracting archive. Decompress an .exe with a virus, and boom, you have a virus.

    But really, it shouldn't be that difficult for Adobe to put a little option on the feature to disable vbs access, should it? As far as I can tell, there's absolutely no vbs out there that should need a viewable, printable PDF mother file.

  • WARNING: If you try to figure this virus out, you will be charged with reverse-engineering and thrown in the pokey!

    I say, if this threat is real, let Adobe wallow in it until they rot: At least ten times as long as the innocent victims [slashdot.org] they try to fuck over.

    --SC

  • Some thoughts... (Score:2, Interesting)

    by rediguana ( 104664 )

    If pdf's are supposed to be cross-platform and portable, then wtf are they putting executable code in them?

    Isn't the whole idea of using pdf's to avoid using word documents and the associated risks?

    And doesn't the article say "including everything from the VBScript programs--used in the LoveLetter virus--to an actual executable program"? Doesn't that mean that it's not a VBS issue, rather the design of Acrobat?

    Right, nothing for it but to let adobe know your thoughts. email adobe with product improvement suggestions! [adobe.com] - like remove the ability to include executables. If Adobe don't do something about this, then they have lost their competitive advantage as a document format.

    • And another thought, if pdf's can now carry executable code (even though it can't execute in Reader), is there the possibility of a buffer overflow exploit in the reader that would allow the executable code to be executed on the machine running the Reader?

  • I send you this pdf... (Score:5, Funny)

    by lavaforge ( 245529 ) on Wednesday August 08, 2001 @09:59AM (#2121194)
    In order to have your advice.

  • Related CNet Story (Score:4, Informative)

    by Anonymous Coward on Wednesday August 08, 2001 @10:00AM (#2121203)
    There's a CNet story on the same news piece here: http://news.cnet.com/news/0-1003-200-6808673.html? tag=mainstry [cnet.com]

  • From the support desk (Score:3, Funny)

    by alnapp ( 321260 ) on Wednesday August 08, 2001 @10:01AM (#2121209) Homepage
    Dear users,
    Please ignore anything we may have said about 'Safe file attachments'. In fact, do not open any of your e-mails, ever again, and, to be safe, just stay in bed.
    Thanks

  • Bah (Score:2, Troll)

    by eAndroid ( 71215 )
    I know the PDF format decently well (I'm writing a PDF library [sourceforge.net]) and I don't think that this is a threat. Besides embedded programs there isn't much that can get executed by the system. Has anyone ever heard of a Postscript virus? That would probably be needed to make a PDF virus.

    However if there is a PDF virus it'll probably just take advantage of a buffer overflow problem in the Windows version of Acrobat Reader. Use Linux (and use Python) and you should have no problem.
    • Besides embedded programs there isn't much that can get executed by the system

      (gulp) This should raise some concern, no?

      Use Linux (and use Python) and you should have no problem

      wheh! I got worried there for a second...I can already see the hords of people downloading the latest distro's to avoid a potential .pdf virus threat. Let's be a bit realistic here.

    • Postscript is a complete language (Score:4, Interesting)

      by coyote-san ( 38515 ) on Wednesday August 08, 2001 @11:20AM (#2116965)
      Postscript is a complete language, the only reason it doesn't make a good viral platform is that the standard library is extremely limited (some disk I/O, no network I/O iirc) and there's no well-known way to call external libraries.

      But make no mistake - it would not be hard to define an extension which allows PS functions to call native libraries. This is the type of extension that could be easily added to support some purpose, without consideration of how this will increase the risk of a viral load.

      Finally, to ask the obvious question of why you would do extensive programming in PS, the reason is simple - it allows your file to adjust itself to the printer. E.g., you might have a file which contains meteorological information on a map. If you print the file on a standard printer you get two dozen reports. But if you print it on a large format printer, you get 4x as much information because the file knows it can push additional information onto the map. Or you might get basic information on a monochrome printer, and additional information on a color printer where you can provide visual distinction between the layers.

      In some limited cases, you can even have the PS file compute its own content. I've seen that done with some fractal graphics - you might send a <1k file which causes the printer to sit and think for an hour. Great stuff for confusing MCSEs - the print queue says it's printing a 1k file, but it's been churning away for looooon time.
      • I've been thinking about this for a while (after playing with GILT [spaceports.com]).

        Lack of I/O facilities means you couldn't create a postscript file that could replicate, but you could still potentially cause a bit of havoc. For example, create a postscript file that uses the random number generator to either print an amusing poster (99.9% of the time) or print several pages of dirty pictures (0.1% of the time). People will print the amusing document, send the file to all their friends, and eventually someone will get into trouble.

    • Has anyone ever heard of a Postscript virus?

      Actually, yes. About ten years ago there was a postscript virus that Did Things to printers. I forget how it worked (it was 10 years ago) and, IIRC, it wasn't very dangerous. Spread through .ps files that accompanied some shareware as I recall.

      • Re:Postscript virus (Score:4, Insightful)

        by mmontour ( 2208 ) <mail@mmontour.net> on Wednesday August 08, 2001 @10:42AM (#2127806)
        About ten years ago there was a postscript virus that Did Things to printers

        There's some info about it here. Was apparantly quite nasty on some hardware, as it changed a password that required an EPROM replacement to correct. This might have been more a "trojan" than a "virus", as I didn't find any references to it spreading itself (just that it could be a payload in clipart or other EPS files).

        http://catless.ncl.ac.uk/Risks/10.32.html#subj1 [ncl.ac.uk]
        ftp://ftp.minolta-qms.com/pub/cts/out_going/dos/po stv.txt [minolta-qms.com]
        http://www.sevenlocks.com/password/pspass.txt [sevenlocks.com]

        I thought that there was also something a few years ago where viewing a postscript file could alter files on your local machine (buffer overflow in a particular viewer program, unsafe default security settings, or something). However I couldn't find any information, so I might be mis-remembering.
        • Display PostScript also made some interesting things possible---there were .eps files one could put in NeXTMail docs which would take over the windowserver on the receiving machine when they were opened.

          Also, look at www.this.net/~frank for a description of ``Akira'' a project to study and provide a solution for that sort of thing.

          NeXT did provide an option to turn off the public windowserver though, as well as to run .eps files safely.

          William

  • adobe strikes again (Score:3, Insightful)

    by White Shade ( 57215 ) on Wednesday August 08, 2001 @10:13AM (#2121694)
    Wow, adobe has struck the Slashdot headlines *again*, and with news that's just as bad, if not worse, than anything else so far...

    I noticed this:
    "But Adobe doesn't currently plan to prevent VBScript or other files from running."

    And the first thing that comes to mind is "gosh, what a totally stupid policy." All they have to do is NOT pass executable data to the script software...

    Who even needs a way to execute scripts OF ANY KIND in a .pdf file?! The whole point of a pdf is that it is supposed to give you exactly what you get on the paper page, in a platform-independent fashion.. Your printed manual can't execute attachments, can it?! All the joys of excessive featuritis..

    On another closely related hand, Isn't it great that we can get Outlook macroviruses with out even opening the attachent in outlook? Just think of the thousands of stupid office workers who are going to start spreading macroviruses without even realizing it... Teaching them not to use attachments in OUTLOOK has been hard enough.. to cope with Acrobat as well?! Damn near impossible....

    *sigh*

    • If Adobe's past actions are any indication, whoever figured this thing out is in deep doo-doo. The coderz article says:

      The password for changing the security options of the PDF file is "OUTLOOK.PDFWorm"

      So somebody's cracked the PDF format, and is now distributing a method of circumventing copy protection on a popular document. This is, of course, a federal crime under the DMCA. I'd advise whichever security expert figured this password out to flee to the safety of Russia immediately.
      • Quote from the Bugtraq mailing list (not by me!) :

        What this means is that virus scanners will now need to "reach inside" PDFs to scan encapsulated files. But what -- as I'm sure our Russian friend Dmitri would ask -- if the PDF is encrypted? Wouldn't the virus checker have to defeat the encryption to see the encapsulated file? And would it be an illegal "circumvention" mechanism if it did?

        --Brett Glass
        I think Brett raises a very good point here.

  • Only in Acrobat (Score:2, Insightful)

    by JerryKnight ( 465510 )
    It doesn't affect the reader, just the high-dollar Acrobat, so how many people will this really affect?

  • Not worried (Score:4, Informative)

    by JediTrainer ( 314273 ) on Wednesday August 08, 2001 @10:05AM (#2137701)
    From the article: "The virus spreads only by way of Adobe's Acrobat software--the program used to create PDF documents--not through Acrobat Reader, the free program that is used to view the files"

    I don't own Acrobat, and I never will. I have other ways of creating PDFs which are cheaper. Most people don't have Acrobat. Most never will. This virus, thus, can't get far.
    • There are plenty of companies mirred in MS legacy stuff that are using this as a way out of printer dependency. Immagine a real virus overwriting corporate document databases. Millions of man hours could be wasted in minutes, even with a good backup policy.
  • This is an OS problem. All "reader" and "player" programs invoked from browsers should run in jails [freebsd.org]. This should have been done years ago.
  • Here is a link to the Bugtraq advisory [securityfocus.com] for this, as well as a fairly insightful reply [securityfocus.com], both of which come from my own submission of this story which was rejected six hours before this one was accepted, not that I'm bitter.

  • Karma (Score:4, Funny)

    by Sternn ( 143817 ) on Wednesday August 08, 2001 @10:59AM (#2148388) Homepage
    Like no one saw this coming? I mean, if anyone deserves this, Adobe looks like a prime candidate. I mean, after all, trying to find out HOW a virus attacks from a PDF file and trying to STOP it could land you in prison for 5 years...
  • This quote from the article makes me think so

    "Right now it's considered to be a low risk because we haven't seen it reported to us from a customer," Network Associates' Gullotto said.

    OK, so how did you guys get it? Must have been internal then.. anyway, my conspiracy theory.

    JOhn
  • When I want to make a PDF-document, I make it look like I want it to look like with any application, let's say Abiword, I print it to a file (postscript) and then I run a little nifty that comes with Slackware called 'ps2pdf'. There we go.

    Then we come to the windows users hmm... good question. If you print to file in windows, doesn't that become a postscript too? And there probably is a port of 'ps2pdf' for windows, and if not I doubt it would be too hard to do that, or maybe there is a similar software. Anyway, it CAN be done obviously...

    -Hans
  • But Adobe doesn't currently plan to prevent VBScript or other files from running.

    To prevent Peachy from being able to run, "the change we would have to make is not to allow VBScript attachments. That is a problem for a lot of our customers," she said. "If they change their opinion, we will do what they want."

    According to many ./ers, this is exactly Microsoft's opinion, and the very problem that has opened the door to the worst virii on the Internet: The company is writing software with features that their customers want--no matter if they pose security risks or not.

    Typical customers want their email client to open attachments for them. Typical customers want Acrobat to be able to process VBScript (according to Adobe). Unfortunately, typical customers don't want to be raped by script kiddies and haX0rz either--but they don't seem to be willing to sacrifice their features for it.

    Where is the balance?

    --SC

    • Apply the same arguments to other areas of safety (Score:5, Insightful)

      by FreeUser ( 11483 ) on Wednesday August 08, 2001 @10:51AM (#2118994)
      Typical customers want their email client to open attachments for them. Typical customers want Acrobat to be able to process VBScript (according to Adobe). Unfortunately, typical customers don't want to be raped by script kiddies and haX0rz either--but they don't seem to be willing to sacrifice their features for it.

      Where is the balance?

      This is a remarkably easy question to answer if you substitute another area of safety people, even clueless Microsoft users, can understand.

      Allow me to paraphrase:


      "Typical customers want to be able to board the plane without delay. Typical customers want to be able to take as much baggage as they luck, up to and including the Steinway. Unfortunately, typical customers don't want to die horribly in a plane crash -- bugt they don't seem to be willing to sacrifice their features for it.

      Where is the balance?"


      Obviously, if the industry cannot police itself, and the free market doesn't yield acceptable results, government regulation is the only reasonable recourse (libertarian knee-jerk reactions aside). In the case of aircraft the FAA has stepped in, and while their are alot of regulations, as a pilot I can say the vast majority of them are reasonable and do a great deal of good.

      Think the aircraft example is too dramatic? Then substitute something else, such as an automobile, a building, or even a child's toy. All of these things have features people would want if they could have them but are incompatible with safety (think seat-belts, firecodes, chilren choking, etc.). In each case the manufacturers were incapable of properly policing themselves and government ended up having to step in (safety codes, building codes, mandatory testing procedures, etc.).

      Microsoft has demonstrated its incompetence to such an extreme that fissionable nuclear materials may well have been misplaced as a direct and demonstrable result of poor quality control in their software. They make no apology for this, blaming instead the victims of their own incompetence (their customers) and claiming it is what their customers want (I would beg to differ). Clearly the industry is not policing itself properly, nor, based on the market share Microsoft currently enjoys, is the free market yielding acceptable results. Similar arguments apply to Adobe, its fraudulantly incompetent copy protection for eBooks and its virus-facilitating PDF file format.

      I know it is a profoundly unpopular idea (and I'm not terribly thrilled with the notion myself), but perhaps it is time for some basic standards of quality and security to be imposed through some form of regulation. The alternative seems to be more of the same, which is clearly not acceptable.

      • I know it is a profoundly unpopular idea (and I'm not terribly thrilled with the notion myself), but perhaps it is time for some basic standards of quality and security to be imposed through some form of regulation. The alternative seems to be more of the same, which is clearly not acceptable.

        You know, I would actually have to say I'm starting to agree with this view. I think it is time for consumers to work with governments to form suitable regulation for the greater good of society. The development of open formats and software would go a long way to support this. I can't see it happening in the US any time soon though, MSFT is paying too much tax!

      • Have you even begun to understand the difference between a human life and data? They are entirely different things - even if a geek who has never stepped out of mommy's basement can't tell the difference.

        The federal government should regulate areas where there is a potential for irrecoverable loss i.e. life or limb. Market forces don't play well there because nothing can compensate for those losses. Computer virii are a whole different beast. The most a computer virus can do is cause loss of data or money. Something market forces are perfectly capable of dealing with and something which government should stay far away from.

        And just because market forces don't seem to work in the direction YOU like it, doesn't mean they don't work at all.

        The argument about the loss of fissionable nuclear material is a strawman. Every piece of software has bugs in it and depending on the purpose you use it for, those bugs can have harmful consequences.
        • I won't go into a long discourse on the niavite of dissaciating information with its impact on the physical world, except to rebut a couple of the more blatently silly comments you made:

          The most a computer virus can do is cause loss of data or money.

          Tell that to the patients who died as a result of a "bug" in the software which was controlling the radiation therepy equipment used in the treatment of their cancer that erroneously delivered a lethal dose.

          Tell that to the aircraft pilots which had their passenger jet flip upside down due to a bug in their computerized autopilot (thankfully the plane was empty and they were able to recover ...barely).

          Computers, and information, have real-world effects which can and do affect, even destroy, real, physical lives, and viruses are as capable of destroying lives as "bugs."

          Something market forces are perfectly capable of dealing with and something which government should stay far away from.

          Ever heard of the SEC? FTC? Even the markets themselves, which you seem to so laude as a panacea, require rather detailed and ongoing government intervention in order to function at all.

          Other holes in this argument abound, including the fact that, in the United States at least, money is required to obtain even nominal medical care, not to mention food and other basics. Destroying one's livelihood is often tantamount to destroying lives ... there's that real world, physical impact again.

          The argument about the loss of fissionable nuclear material is a strawman.

          No, it isn't. It is a verifiable, and verified, event which resulted from extreme incompetence and negligence on Microsoft's part, exacerbated by their indefensible unwillingness to acknowledge, much less take responsiblity for, their own product's shortcomings. Furthermore, it is a perfect example of how information and its destruction can, in fact, potentially endanger millions of lives, and why government regulation requiring certain minimum standards in quality control and security are not at all unreasonable.

          Indeed, you rebut your own point in the next sentence you write:

          "Every piece of software has bugs in it and depending on the purpose you use it for, those bugs can have harmful consequences."

          ... which is why we have safety regulations for everything from medical equipment to aircraft to automobiles to elevators, because those bugs can have harmful consequences, whether they are bugs in software, firmware, or hardware. And why minimum standards for software quality and security aren't so unreasonable after all.

  • PDF Virus a *Proof of Concept*, not a real threat (Score:3, Interesting)

    by Phoukka ( 83589 ) on Wednesday August 08, 2001 @10:36AM (#2150186)
    As many have already noted, the embedded VBScript will only run when triggered by someone double-clicking on the file annotation included in the PDF while using the full version of Acrobat. Thus, the virus is not particularly dangerous.

    The social engineering, however, is pretty amazing. The author has created a neat little PDF "game" that people will want to double-click. And, as he wrote in the text file linked above, he wrote it as a proof of concept. The worm doesn't do much except spread itself using Outlook. I think the scary part, the point the author wanted to make, is that you can embed all sorts of fun things in a PDF file. Some other virus writer could make a new version that does something nasty after it emails itself to every address it can find in your Outlook folders.

    Yes, the threat level is low, due to the required combination of software and social engineering. But just because the combination of software is rare doesn't mean that we should disregard the possibility.



    Now for a display of massive ignorance: I wonder what a PDF virus could do on a system whose GUI is based on PDF (Mac OS X)?
    • Well, the Code Red exploit was once a proof of concept. I still have the original post from the NTBugtraq list outlining the vulnerability...

      I think we're going to come to the point where *any* embeddable-type document is going to be prone to infestation. We're almost there. We just need to add .swf, .psd, and the complex audio formats coming out. Play a Music Stream from Real and get a virus!

  • Do they WANT virii? (Score:5, Insightful)

    by imadork ( 226897 ) on Wednesday August 08, 2001 @10:06AM (#2153420) Homepage
    In the ZDNET Article [zdnet.com], it has this statement:

    Adobe said any popular software becomes a target for security attacks and Acrobat has crossed that threshold.

    I'm convinced that software companies now WANT viruses to run on their software, because it "proves" the software is popular. If I were Adobe, I would distance myself from the virus by saying "PDF's can now carry VBScript viruses, but VBScript is still broken with respect to security, so blame Microsoft for any viruses!" After all, the problem is with the fact that VBScript can't be trusted, not with any inherent security problem in Acrobat.

    Instead, Adobe seems to WANT to associate their software with the viruses, because Microsoft has conditioned the media into thinking that having a virus have its way with your software proves that you're the Market Share Leader.

    After all, if nobody writes viruses for, say, UNIX platforms, it must mean that they aren't as popular!

    • Considering that it's adobe, I hope they drown in them. But do remember that the pdf format is one that they are currently trying to replace.

      If they can convince enough people that pdf is too dangerous, then they may be able to switch them over to the ebook standard. Because that's safer.

      It is likely to be a long time before I trust adobe to do anything honorable. It's likely to be a long time before I trust them again for anything. I think a partial requirement would be a total change in upper management. And that wouldn't be sufficient. That's just necessary.
  • This may seem trivial but i am wondering if /. has declraed war on Adobe as well as MS ?

    This article is not new and PDF files are vulnerable if you launch an embedded attachment, but then again so are MS Word, etc etc.

    All this shows is that if you go looking for something bad then you are going to find it if you look hard enough, and i think the skylarov case means everyone would like to 'get' adobe

    (im not commenting on the merits of the case - but i will say that i think both parties are at fault, skylarov for cracking a proprietry format and adobe for over reacting in a big way - the thing is the PDF format IS proprietary - you need adobe software to make it and view it there fore they have the right to protect their copy right but i think they way they and the US gov went about it is heavy handed and stupid - this guy is not some desperate hacker)

    But the thing is the medias coverage of non threats like this, minor threats to the home user like code red and things like good times, michelangelo, hackers defacing web pages etc etc and blowing these said events up to be the end of the world as we know it builds hysteria in the general populace who then call for the govt to crack down on these 'terrorists' - thus they carry out heavy handed actions.

    If we all dont watch out we are in for a nother McCarthy like era but instead of reds under beds we will have hackers under the table!!

Slashdot Top Deals

Civilization, as we know it, will end sometime this evening. See SYSNOTE tomorrow for more information.

Close