digg

Facebook Connect Join Digg About

Is it time to consider PDF a threat?

arstechnica.com — The 8.12 patch for Adobe Reader that Adobe released last week fixed a number of security holes—but not before malware capable of exploiting them had been on the market for weeks. The end result is tough questions on whether it is time to consider PDF a security threat.

Who dugg this? Made popular Feb 13, 2008

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

135 Comments

show profanity settings
expand all
  • ArthurSucks, on 02/13/2008, -2/+116Perhaps there is more and more reasons to use third party readers. Foxit is still my favorite in Windows.
  • ChefGroovy, on 02/13/2008, -4/+86Adobe Acrobat is bloatware at it's finest. Or worst (?)

  • thenativeraver, on 02/13/2008, -2/+62Foxit FTW!
    http://www.foxitsoftware.com/downloads/
  • totorototoro, on 02/13/2008, -0/+52Its not the format that is the real threat. Its having Acrobat Reader on your machine.
  • ThinkBox, on 02/13/2008, -4/+39Terrorists use PDFs
  • shirosamurai, on 02/13/2008, -0/+34PDF isn't the problem, it's actually very useful for certain types of documents. The problem is Adobe Reader/Acrobat, which is the most bloated piece of ***** I've ever used. It shouldn't take 15 seconds to load a PDF, nor should the PDF reader itself be 22 megabytes in size (and thats just the installation package).

    For reading PDFs, all you need is Foxit, and for making them, all you need is PDF Creator (http://sourceforge.net/projects/pdfcreator/). Both free and lightweight options.
  • inactive, on 02/13/2008, -14/+45What is this Acrobat Reader program you speak about? Is it similar to the super-slick and uber-fast Preview?
  • Cannon49, on 02/13/2008, -0/+29I use foxit as well

    Screw adobe with its resource hogging bloated PDF reader.
  • afx1, on 02/13/2008, -0/+28pdf is a format. it's the software that reads it that's a threat. in this case, acrobat reader.
  • rikwakefield, on 02/13/2008, -1/+18Acrobat Reader:- following in the ***** footsteps of Real Player.
  • luchid, on 02/13/2008, -6/+22Why is he getting dugg down? Acrobar Reader IS bad, and Preview is pretty damn awesome.
  • BinaryFragger, on 02/13/2008, -1/+16We use Adobe Reader 8 (ugh) at work, and the 8.1.2 update was automatically downloaded yesterday. After I installed it, it said my computer needed to be rebooted.
    Why the hell does a PDF reader require a reboot for installation?

    At home, I use FoxIt. Small and lightweight, never had a problem with it.
  • cheesejaguar, on 02/13/2008, -9/+24Phew, good thing I use OS X, which uses Preview instead of Adobe Acrobat.
  • crapmatic, on 02/13/2008, -0/+14Acrobat Reader 2 (1.4 MB)
    Acrobat Reader 3 (3.9 MB)
    Acrobat Reader 4 (5.2 MB)
    Acrobat Reader 5 (8.4 MB)
    Acrobat Reader 6 (15.9 MB)
    Acrobat Reader 7 (31.5 MB)

    Go bloat!

    Acrobat has also made oldversion.com take Acrobat off their site so you can't get the older good stuff. ***** Adobe.
  • Chompy, on 02/13/2008, -2/+15The problem isn't the format, it's Adobe. Grab foxit or another third-party app, it will make your life much easier.
  • intangible, on 02/13/2008, -0/+11That task doesn't seem all that widespread. Most people just want to read the PDF.
  • NonLeftistDiggr, on 02/13/2008, -0/+11I don't know if threat is a word, but you have to be somewhat versed in computers to prevent this freaking document reading program from taking your computer over. I have tamed it finally, but there's nothing I can do about the 120MB install. WTF DOCUMENT READER.... WTF??
  • secleinteer, on 02/13/2008, -0/+9Why did you install Adobe Reader if you installed Foxit....?
  • stutimandal, on 02/13/2008, -0/+7Adobe is overdoing its PDF reader. They can do whatever they want to with PDF Professional, but the latest free reader sucks.

    I like Ghostview and I think it is still the best. (It can open PS, EPS, as well as PDF documents)
  • Smaulz, on 02/14/2008, -0/+7Actually, PDF is VERY useful. It's just about the only file type out there that maintains perfect, platform-independent text and graphic formating. A must if you're a designer. I do, however, loathe and detest Acrobat and all it stands for.
  • andycr512, on 02/13/2008, -3/+10"but there's nothing I can do about the 120MB install"

    http://www.foxitsoftware.com/pdf/rd_intro.php is something you can do.
  • luchid, on 02/13/2008, -2/+8So we should allow sloppy programmers to get away with it simply because you can have a resouce hogging app protection you from it?
  • inactive, on 02/13/2008, -0/+6The problem is in people misusing PDFs.

    There's some places that use them when, honestly, HTML woulda done just fine.

    eBooks - good use of PDFs.
    Restaurant menus or nutrition facts - terrible use.

    And *most* places misuse them. Then on top of Adobe's bloatware, it turns into an overall annoying process whenever a PDF is present.
  • luchid, on 02/13/2008, -2/+8Adobe is not the name of the program, it's the name of the company. I pity the organization you work for if you can't even get that straight.
  • Plughie, on 02/13/2008, -0/+6I love Preview, but it sometimes renders PDFs improperly Fillable forms have been the worst. I haven't confirmed this with Leopard.
  • andycr512, on 02/13/2008, -0/+6If my post is redundant then he didn't notice the redundancy, since he didn't know there was a choice other than Adobe Reader, and it was he whom I replied to.
  • TheAnomaly, on 02/13/2008, -1/+6Foxit is a fantastic alternative. :D
  • Hello1024, on 02/13/2008, -1/+6NO - WRONG.

    If a security exploit allows bad code to execute under root/admin privilidges, it can disable or hide itself from the anti-malware app. Many bits of advanced malware now are undetectable by most brands of up to date malware scanners when the malware is running. Rootkits are a prime example.

    As soon as you've got bad code running under admin permissions, you've lost the battle. The only reasonable way to stop malware is at the city walls, not when it's already infiltrated the city.

    Malware scanners are still good for scanning files before execution though, a place where they provide a reasonable level of protection.
  • jonshipman, on 02/13/2008, -0/+5Quark is the devil. I'd pick a document that was smeared into existance from poop than accept a Quark file.
  • kaeves, on 02/13/2008, -0/+5Does anyone know if Foxit has ever been vulnerable to any PDF file malicious exploits?
  • madcat87, on 02/13/2008, -1/+6And who is forcing you to use Adobe Reader !? Okular is great.
  • rikwakefield, on 02/13/2008, -0/+5You've missed the point. The point is there's no need for a PDF reader to be so bloated that it creates potentials for security threats.
  • moletimer, on 02/13/2008, -0/+5I use Sumatra PDF. It's light and fast. Not tried foxit yet though.
  • jjpertusch, on 02/13/2008, -2/+6i used to be a big foxit supporter but for my job i have to leverage material from a pdf file every once and awhile and foxit is terrible at grabbing images.

    try grabbing an image off of a pdf file with adobe's reader and then with foxit and pasting it into word or powerpoint. the adobe grab is high quality and clear while the foxit grab is muddy and distorted. at least for me.
  • Stalks, on 02/13/2008, -0/+4Surely you are using a software management system? If not, why not? Even AD on its own has GPO based software installation.
  • jdfoote2, on 02/13/2008, -0/+4Seriously - how much space and memory does it take to DISPLAY A DOCUMENT! :)
  • antdude, on 02/13/2008, -0/+4Everything is a threat these days. :(
  • nonnald, on 02/14/2008, -0/+4no one on digg, but if you're looking for someone to correct every minor grammatical error, you've come to the right place.
    /sarcasm
  • rikwakefield, on 02/13/2008, -0/+4This is the best advice. I recommend everyone take heed and make a point that we won't accept this unneccessarily bloated craptastic software.
  • tristan55555, on 02/13/2008, -0/+3On Mac - Skim FTW - http://skim-app.sourceforge.net/index.html
  • Timmmm, on 02/13/2008, -0/+3PDF is *part* of the problem. Originally it was a simple 'fancy text' type format that was easy to parse and render and only a fool (or someone using C!) would write a reader with security vulnerabilities. However over the years Adobe has added features that no-one really needs or uses such as scripting and embedded media. These increase the complexity significantly and are also the *kind* of thing that people write badly and with vulnerabilities.

    Of course any good programmer can write a PDF reader that doesn't suck and isn't insecure, but by adding these features Adobe have made it harder.
  • spidoman, on 02/13/2008, -0/+3Supposedly they fixed it, but it blows from my experience. I've used PDF's with a submit button, great with adobe, preview, not happening.
  • skyshock1, on 02/13/2008, -0/+3I'd like to see PDF's get back to their intended use - being a portable format that looks EXACTLY on screen as it looks on paper. Not some ***** web-form/script processing interface that Adobe have bastardized it into.
  • inverselogic, on 02/13/2008, -1/+4Phew, good thing I dont have a poster of Steve Jobs' ***** in my room..
  • inactive, on 02/13/2008, -3/+5What does Probability Density Function have to do with anything?
  • mikes1, on 02/13/2008, -0/+2It's worse than that. If you don't regularly upgrade, it wants to install each and every upgrade, rebooting after each. That can waste and afternoon.

    Adobe Acrobat = bloatware.
  • duccodude, on 02/13/2008, -0/+2Perhaps it was a typo?
  • Vaktathi, on 02/13/2008, -0/+2While Acrobat may have its problems, the PDF format is fine. I think the article is going a bit overboard.
  • AriaStar, on 02/13/2008, -1/+3They've only been noticing this for "several weeks"? I'm a security analyst and we've been seeing this kind of attack since last spring. .pdf files host all kinds of malware, as well as phish and spam. It's been a pain in the ass to deal with.
  • revjustin2, on 02/13/2008, -0/+2I think it's time to consider your mom a threat.
  • Fetching more discussions...
    Show 51 - 100 of 135 discussions

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...


© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.