Dennis Fisher talks with Anup Ghosh, founder and chief scientist of Invincea, about the rise of browser and PDF exploits, the company’s new virtualized PDF security product and whether the Reader X sandbox will make a difference in preventing widespread PDF attacks.
By Chris Greamo
Over the past few years, malicious PDFs have become common place and a prefered vector for attackers. Last week, Adobe announced the release
of Reader X – the much anticipated next major release of
their ubiquitous document reader, which includes a new security feature
called ”Protected Mode”. Protected Mode is designed to restrict the
ability of an attacker who exploits Reader using a malicious PDF to
damage, modify, or gain full control of the underlying host.
Adobe has released the much anticipated new version of its Reader software, Adobe Reader X, which includes the new sandboxing feature meant to prevent exploits against the software from affecting other applications on a PC.
The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access to compromised machines.
For some time now, the browser has been the most dangerous piece of software on the Web, and to hear researchers tell it, the climate it likely to get far worse before it gets any better.
Web based attacks and botnets kept enterprises on the defensive in the third quarter, 2010, according to data released by Cisco Systems.
Adobe on Tuesday released an emergency patch for several critical vulnerabilities in Adobe Reader, including the recent Adobe Flash bug and a separate flaw that was disclosed earlier this month.
Once the most common form of malicious computer network, botnets that use the IRC (Internet Relay Chat) protocol are going the way of the Brontosaurus, according to a report from Internet security monitoring firm Team Cymru.
In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass the Windows driver-signing protection.
We know a lot about the effects of malicious programs like rootkits and Trojan downloaders. The job of finding out exactly how the programs work, however, is painstaking. That’s because most malware authors worth their salt take steps to make their creations hard to understand. Code obfuscation and anti-debugging are common features of most sophisticated, modern malware. With patience and endurance, however, researchers are often able to pierce the veil, anyway.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
