Attacks employing poisoned PDF files have leaped to the top of the threat list, according to statistics from major security companies. Symantec reports that suspicious PDF files skyrocketed in 2009 to represent 49 percent of Web-based attacks that the company detected, up from only 11 percent in 2008. The next-most-common attack, involving a good old Internet Explorer flaw, was far behind at 18 percent. In a typical scenario, crooks might hijack a legitimate site and insert a PDF file made to exploit flaws in Adobe Reader. They then link to that PDF via social-engineering lures such as spam or comments on a blog or social network. Even astute users who check the link would see a legit domain. Not knowing the site was hacked, they would be more likely to download and open the file. Now, a new threat allows for launching malware hidden inside a PDF file. In this type of attack, discovered by researcher Didier Stevens, opening the PDF file triggers an attempt to install the malware. The action causes Adobe Reader to produce a confirmation pop-up, which gives you a chance to halt the attack by clicking the ‘Do Not Open' button - but Stevens found that attackers could tweak the pop-up's message. His example reads, “To view the encrypted message in this PDF document, select ‘Do not show this message again' and click the Open button!” Using such a message, attackers could allay potential victims' suspicion. This embedded-file threat makes creative use of functionality built into the PDF standard. As such, it works not only on Adobe Reader but on other PDF readers, too, even if they're up-to-date. How to fight the new threat Changing a program setting in the current version of Adobe Reader can help. Head to Preferences, Trust Manager, and deselect Allow opening of non-PDF file attachments with external applications. The latest 3.3 update for the Foxit PDF reader also has a new Safe Reading setting - enabled by default under a new Trust Manager section in the preferences - that likewise blocks embedded programs from running. Since traditional PDF exploits almost always hunt for one of the many holes in Adobe Reader, using an alternative PDF program is a good idea. But it's no guarantee of safety. Whichever reader you use, it's vital to keep it up-to-date. Finally, a good antivirus program may stop a malicious PDF before it can launch an attack. And VirusTotal.com is excellent for scanning any downloaded or e-mailed file with a multitude of antivirus engines.
