Invincea recently moved Internet Explorer into a virtual environment. Now, it moves Adobe Reader, to protect enterprises from PDF exploits.
Invincea is taking the idea of sandboxing one step
further, by moving all PDF files into a virtual appliance.
Invincea Document Protection, introduced Nov. 22, runs as a virtual machine on
the user's desktop. Whenever a PDF file is opened, Invincea Document Protection
takes control away from the installed PDF reader, such as Adobe Reader, and
opens the file inside its virtual operating system. If the PDF has any
malicious code, it affects Invincea Document Protection's virtual system and
not the user's computer.
"You are going to get infected anyway, so why not just
infect the virtual machine?" said Anup Ghosh, Invincea's founder and chief
Unlike many security products that open only "unknown" files
in a sandbox environment, Document Protection treats every PDF file as a
potential threat. With links and attachments coming from seemingly trusted
sources, such as links to e-cards from friends and family, it's not easy to
separate the threats from the good, said Ghosh.
People also tend to consider PDFs are safe, and while
they may not click on an unknown executable file, may have no qualms about
opening a PDF file, he said. That is dangerous, as PDF
continue to be on a "sharp incline" according to Ghosh.
"Nearly half of all security threats came from Adobe
in 2010," he said, noting the number of zero-day
exploits targeting Adobe Reader recently.
If the opened PDF file turns out to contain malware,
whether as a suspicious script, a corrupt file, or a damaging program, it
attempts to make the change to the virtual operating system. The change to the
VM alerts the software, which then terminates the file, informs the user that a
threat was found, and deletes that instance of the virtual environment
Every time the user opens a PDF, a brand-new instance of
the virtual machine is created to ensure the user always starts from a clean
The software also collects detailed security forensics
data, such as the source of the file, the changes it made to the virtual
system, and what it tried to do online or on the network. The data can be used by
IT managers or another security product to understand the threat.
Even Adobe acknowledged the importance of sandboxing, as
it introduced Protected Mode in its latest Adobe
. Under Protected Mode, PDF processes such as PDF and image
sandbox, said Adobe.
According to Ghosh, however, Protect Mode will not
prevent unauthorized read access to the file system or registry, restrict
network access, or prevent reading or writing to the clip board, so some
threats still remain.
Microsoft has also added sandboxing to Office, and Google
implemented it into its Chrome browser.
The Invincea Document Protection is an optional extension
to the company's Invincea
software. With the Browser Protection, the Web browser
runs in a virtual environment, allowing users to browse the Web without any
risk to their computers. Any downloaded malware makes changes to the virtual
machine, and when the browser is closed, the virtual instance is deleted,
removing any changes.
While a few years ago, creating a virtual appliance on
the desktop may have taxed user hardware, Ghosh said modern hardware generally
come with sufficient memory and have a fast enough processor to easily handle
Invincea's security appliance.