PDF Users to be Aware of New Malware Campaign

The security firms lately cautioned PDF users to be wary of a new malware attack hoping to exploit innocent users by making the use of unfixed design vulnerability in PDF format, as per the news published by PLANET PDF on April 29, 2010.

This time the tool used by malware authors to launch attack is e-mail. According to Mary Grace Gabriel, an engineer in the security group of CA, the malicious e-mails impersonate as a message from company's system administrators. The subject line of the e-mail reads: "settings for your mailbox are changed", as per the news published by COMPUTERWORLD on April 28, 2010.

Reportedly, the PDF attachment holds directions for resetting e-mail settings. In the e-mail, a statement reads, "SMPT and POP3 servers for.....mailbox are changed". Users need to carefully read attached directions to update their settings.

On opening attack PDFs, users got infected with "Emold" or "Auraax", a Windows worm's variant.

/Launch function of the format are used by PDFs attacks to implement that malicious software on Windows computers running on latest edition of Acrobat utility of Adobe Systems or free Adobe Reader and other PDF viewers like Foxit Reader

The worm delivers a rootkit on the affected system and attempts to drop its copies on all detachable drives, like flash drives, to circulate by the use of "Autorun" ploy that was made famous by the Conficker worm.

Autorun is the main focus of the US-CERT warning. It permits Windows to execute any program that is specified in "autorun.inf" on, like a flash drive or a Compact Disc, the moment the device or the disc is connected or inserted. By default, Autorun is enabled in Windows.

Notably, no official response has been given by Adobe in the context of this latest malware issue. However, Brad Arkin, Adobe security and privacy head, stated in his blog that Adobe knows about the recent issues that are mentioned by various companies. The Company is working towards addressing the security on the whole, for both Adobe Reader as well as Adobe Acrobat users, as reported by Planet PDF on April 29, 2010.

In the meantime, security firms have warned PDF users to be suspicious of PDF attached e-mails as they could be rogue. Also, users need to be cautious while opening these PDFs.

Related article: PDF flaw gets fixed with Adobe patch

» SPAMfighter News - 5/10/2010