Hacker Finds PDF Exploits

In Britain a security investigator has found a way to modify Adobe PDF (Portable Document Format) that can be applied for accessing PCs clandestinely. David Kierznowski, the specialist who detected the weakness, has established the proof-of-concept method to change PDF files to display the weaknesses in Acrobat Reader package, which could strike computers automatically.

"I don't actually believe these assaults to be flaws in Adobe, rather it's actually the result of exploiting those features endorsed by the product but were never intended for this. However, it is evident that any malevolent program [can] be started," alleged Kierznowski.

The primary variation of this illegal access entails appending a malware connection to a PDF file. The web browser starts mechanically & transfers the link once the affected PDF file is exhibited.

The next variation uses Adobe Database Connectivity (ADBC) & the back up aspect of net services supposedly capable of tapping totally repaired Adobe Professional package. The investigator has affirmed of nearly 7 other flaws that can be misused by a cyberpunk.

"The attack infiltrates Windows ODBC (on local server), notes existing information and then dispatches this data to 'local server' using the Internet. This strike could be extended to execute real file scrutiny. Envision hackers reaching your personal infos thru an end user's browser. Using a little extra innovation, still easier and/or more progressive strikes could be designed," he stated, observing that Adobe Acrobat endorses the utilization of "HTML variants" and "File system access code."

Proper investigations have been guaranteed by Adobe about this matter. "In case Adobe corroborates that a weakness may impact any of our wares, particulars of the security flaw and a suitable resolution shall be certified and issued," as per the company's announcement made in eWEEK.

Dynamic manipulation methods like buffer spills are getting increasingly hard to locate. The prospect of manipulation exists in Net applications and just fakes the Computer user's to execute a specific task, successfully infiltrating their system,"

Reasserting a tendency that comprehends Microsoft Office programs -- Word, PowerPoint, Excel, -- employed in zero-day assaults, Kierznowski envisions a prospect of guest-side cyber attack that increases service utility.

Related article: Hacker & Virus in MySpace

» SPAMfighter News - 9/25/2006