Adobe Reader, Acrobat security issues -- again!

In respect to the latest in a series of security vulnerabilities with Adobe Reader and Adobe Flash, Adobe says, "We are in the process of fixing the issue, and expect to make available product updates for the relevant supported Adobe Reader and Acrobat versions and platforms by May 12th, 2009."

"SANS NewsBites" newsletter editors comment that users of Adobe Reader and Acrobat may want to consider less-exploited alternatives. Adobe Reader keeps bloating in size and Acrobat seems way over-priced, so perhaps it is time to start looking elsewhere.

• Adobe Product Security Incident Response Team (PSIRT) blog
• Adobe Acknowledges Reader, Acrobat flaws (SANS NewsBites)

Beware nasty Mebroot trojan

Beware of malware called Sinowal (also as Mebroot) captures bank and similar data. A gang of Internet criminals have been using this and even morphing the malware to temporarily fool antivirus software.

Windows Secrets contributing editor Woody Leonhard likens Mebroot to "a parasitic operating system that runs inside Windows". [Disclaimer: I subscribe to the paid version of "Windows Secrets" newsletter. Prior to that subscribed for years to the paid version of Fred Langa's "LangaList" newsletter, which is now integrated into Brian Livingston's "Windows Secrets" newsletter. I highly recommend Windows Secrets anyone concerned about or interested in PCs.]

Leonhard says that his experience is that a lot of systems get infected with Mebroot (Sinowal) because the owners did not keep up with Adobe Reader, Adobe Flash, or Apple Quicktime security patches. You can manually check for such patches, set the apps to automatically check for updates, or (even better), install the free Secunia Personal Software Inspector (PSI) and scan for programs that need updating.

In October 2008 Brian Krebs, Washington Post, alerted readers to the "virtual heist" going on. Mebroot infects the Master Boot Record (MBR) of your PC and sends personal data to its "owners". Krebs says that the criminals have stolen over half a million credit and debit card account in the past few years.

While Symantec lists the malware's risk as low, if your data gets stolen, it won't be a little thing to you. Here are some actions Symantec and I recommend to reduce your risk of malware infections:

• Use a firewall
• Enforce complex passwords for all users of your computer
• Use the lowest level access privileges.
• Never use an Administrator-level login account as your normal one. Always login as a lower level account and then "Runas" or login as the Administrator level only as needed. Vista security is a big advance in making this type security easier. Yes, you get pop-ups to login as Administrator, but that's much better than manually running a "runas" command and you don't need to know the runas command line syntax.
• Disable Auto-play
• Turn off "File Sharing"
• Turn off and remove unnecessary system services
• Always keep your programs patched (You can use the free Secunia PSI to monitor patch status)
• Don't open email attachments unless you were expecting them. Contact the sender separately (not by a "Reply") and see if they really did send you that email and attachment.
• Turn off Bluetooth via Windows Control Panel if you are not using it.
• If you really need to use Bluetooth, make sure every Bluetooth device's visibility is set to "Hidden".

Patch Adobe Reader, Acrobat!

If you use Adobe Reader 8.12 or earlier or Adobe Acrobat 8.12 or earlier, update them now! Adobe has released security updates to critical vulnerabilities.

Better yet, for Adobe Reader, upgrade to the version 9 -- it's free.

Both programs come configured to automatically check for updates, but some people turn that off. Leave the auto-check on -- protect yourself.

Non-Microsoft security updates

Several security updates came out recently for products other than Microsoft ones, although a couple apply only if you are using Internet Explorer version 7. If you have the following software, make sure you get the patches:

• Adobe Acrobat 8
  
• Adobe Reader 8.1.1
  
• Apple Quicktime 7.2
  
• Mozilla Firefox 2.0.0.8
  

Adobe Reader vulnerable

Adobe Reader has a serious vulnerability that could be exploited by a maliciously created PDF. The flaw could be exploited to take control of computers. So far, Adobe has no patch for it

Until this vulnerability is patched, do not open a PDF file you get unless it's from a trusted source and you were expecting the file.

If the source is trusted but the file unexpected, contact the sender before opening the PDF.

Outdated programs risky

Many programs these days need updates, not just your operating system (e.g. Windows). As an example, today's Windows Secrets points to the following common programs:

• Adobe Reader
• Macromedia Flash
• Apple Quicktime
• Sun Java
• Mozilla FireFox

Most of these programs default to checking for updates. But if you ignore the update message or if it only checks once a month, you can be way behind in plugging security holes (a.k.a. "vulnerabilities").

What can you do about that? One very big help is the free Secunia Personal Software Inspector (PSI). You can try it online first and download if it serves as an eye opener for you -- it did for me.

For one thing, I discovered old versions of Sun Java on my system. Any "point" version needs to be updated to its most recent one. For example, the only currently secure versions of Sun Java JRE are version 5 update 12 and version 6 Update 2 (also known as 1.5.0_12 and 1.6.0_02)

Adobe Reader 8 - get it

Adobe has released Adobe Reader 8.0. Adobe considers it a critical update to version 7 for security reasons.

Get Adobe Reader 8.0.

Caution – Adobe will install Yahoo! Toolbar by default unless you specifically deselect (disable) that. I do choose not install Yahoo! Toolbar or Google Toolbar. I use IE7 and avoid the extra "overhead" that the toolbars introduce, to say nothing about possible glitches or conflicts.

After you install it, select "Edit", then "Preferences" from the menu bar and check every single option. Many options are now located in different places from the prior versions. For example, you can choose to set the default display of a "document" to single page, continuous. I prefer that to the unnatural page "jump" that happens by default when you reach the bottom of a PDF's page.

Also, a toolbar button for copying text in a PDF is not present by default. Check out each option. Experiment. You can always change it back.