Adobe said a previously undisclosed vulnerability in its Reader and Acrobat applications was passed along by defense contractor Lockheed Martin, raising the specter of a targeted attack on the important military supplier.
In issuing a warning about a critical flaw on Tuesday, Adobe credied both Lockheed Martin and the Defense Security Information Exchange (DSIE) with reporting the hole. Those following the industry closely say that the two organizations were likely targeted in an attack leveraging the zero-day.
“My guess is that they got targeted and reported it to Adobe,” Mila Parkour of the Contagio Malware Dump blog told ComputerWorld’s Gregg Keizer.
Adobe initially gave credit to MITRE (as well as Lockheed), but has since revised their security advisory, giving credit to the DSIE instead MITRE. All three organizations are part of Defense Industrial Base (or DIB), of which the DSIE is a subset. Numerous government reports in recent years have described a sustained and sophisticated campaign of hacks and online attacks on DIB members, with many trails leading back to the People’s Republic of China and Russia. In November, the Office of the National Counterintelligence Executive made the U.S. government’s boldest claims yet about the cyber spying, accusing both countries of conducting far flung cyber espionage campaigns against U.S. and other Western firms in an effort to promote domestic interests.
Neither Lockheed nor the DSIE responded to Keizer’s requests for comment. Adobe is reportedly planning to ship a patch for this bug next week.
This is the second time this year that Lockheed has appeared in security headlines. They hit the news earlier this year, after attackers leveraged SecureID Tokens stolen from RSA in a separate attack also involving Adobe.
