Adobe Acrobat and Reader under attack with a zero-day exploit

By Fahmida Y. Rashid Published September 9, 2010

Adobe identified a critical vulnerability in Adobe Acrobat and Reader on Tuesday, but said today that attackers were already exploiting this bug. All versions of Acrobat and Reader 8 and 9 for Windows, Macintosh, and Unix are open to attack. Even the latest versions, 8.2.4 and 9.3.4 are not safe. Other PDF reading alternatives, such as Foxit Reader, are not affected.

Masquerading as a harmless PDF file, this exploit has malformed font and image files. Spreading as an e-mail attachment to innocent-sounding emails, the PDF saves and runs an executable file to disk when it’s opened. A variation of the email offers tips on ways to improve your golf game. Security firm Trend Micro spotted a variation with a Trojan, TROJ_PIDIEF.WM, that downloaded two other Trojans called TROJ_DLOADR.WM and TROJ_CHIFRAX.BU.

Recommended Videos

This vulnerability bypasses Windows 7’s vaunted security measures. The executable file that gets saved carries a valid digital signature, so Windows 7 allows the operation. Because a valid signature pretty much tells Windows 7 that it’s a safe file, this executable is free to download more malicious code from a server at academyhouse.us. According to Kaspersky Lab, the file appears to be form Vantage Credit Union in St. Louis. It also piggybacks on loopholes created by applications that haven’t included Windows 7’s ASLR security technology in their own code.

Adobe “is in the process of evaluating the schedule for an update to resolve this vulnerability,” and hasn’t announced any fixes or patches. The regularly scheduled patch date is Oct. 13, but an emergency patch is not out of the question.

There are reports that turning off JavaScript in Adobe Reader stops the PDF file from executing. This is only a temporary measure, as attackers can tweak the exploit to issue variations that are immune to disabling JavaScript.

Fahmida Y. Rashid

Former Digital Trends Contributor

Topics

Computing

Researchers develop a new forensic tool that can recover deleted AI chats from your phone’s memory

Pressing delete on your AI chat doesn’t mean it’s actually gone. ORISA can recover deleted conversations from your local AI apps.

recovering-deleted-ai-chats

Did you think hitting delete on your AI chatbot conversation actually makes it disappear? Georgia Tech researchers just proved that's not entirely true. They have built a forensic tool called ORISA that can dig deleted conversations from your phone and even rebuild them into a working chatbot session you can keep talking to.

How can ORISA bring deleted AI conversations back?

Computing

Apple’s “Pro and Tell” October 28 event: Everything we expect from touchscreen MacBooks to a new iMac

Prepare for a touchscreen MacBook that costs around $3,000.

Computer, Electronics, Laptop

Touchscreen laptops have been around for years. You can get them in all sizes and shapes. Just not from Apple. For years, the Cupertino giant has treated the idea of a touchscreen MacBook the way I treat a meeting that could have been an email: with open contempt. However, Wednesday looks like the day the company could finally change its mind.

The latest Apple invite puts the “Pro and Tell” showcase in Los Angeles at 10 a.m. PT (1 p.m. ET) on October 28, 2026. Instead of a regular live-streamed keynote, it is an invitation-only, hands-on event for a handful of press and creators (similar to what the company did for the MacBook Neo earlier this year).

Computing

Those cute delivery robots could be the new Flock surveillance menace

Dinner is served, but who asked for a biometric scan?

Food delivery robots

Two residents of Chicago have filed a lawsuit in the US over claims that robots run by Coco Robotics and Serve Robotics captured their facial and hand measurements without consent, bringing renewed attention to the food delivery robots. The cases raise a troubling question: If a robot delivers food to your door, can it also be gathering sensitive information about you?

According to a report by The Associated Press, the proposed class-action lawsuits were filed in Cook County on Oct. 9 and allege violations of Illinois’ Biometric Information Privacy Act. The complaints claim that the robots’ cameras and LiDAR sensors captured information on customers’ faces and hands as they approached the machines to pick up their orders. Both have denied the allegations.