Invincea Uses Virtualization to Protect PCs from Malicious PDFs

Invincea is taking the idea of sandboxing one step further, by moving all PDF files into a virtual appliance.

Invincea Document Protection, introduced Nov. 22, runs as a virtual machine on the user’s desktop. Whenever a PDF file is opened, Invincea Document Protection takes control away from the installed PDF reader, such as Adobe Reader, and opens the file inside its virtual operating system. If the PDF has any malicious code, it affects Invincea Document Protection’s virtual system and not the user’s computer.

"You are going to get infected anyway, so why not just infect the virtual machine?" said Anup Ghosh, Invincea’s founder and chief scientist.

Unlike many security products that open only "unknown" files in a sandbox environment, Document Protection treats every PDF file as a potential threat. With links and attachments coming from seemingly trusted sources, such as links to e-cards from friends and family, it’s not easy to separate the threats from the good, said Ghosh.

People also tend to consider PDFs are safe, and while they may not click on an unknown executable file, may have no qualms about opening a PDF file, he said. That is dangerous, as PDF exploits continue to be on a "sharp incline" according to Ghosh.

"Nearly half of all security threats came from Adobe application exploits in 2010," he said, noting the number of zero-day exploits targeting Adobe Reader recently.

If the opened PDF file turns out to contain malware, whether as a suspicious script, a corrupt file, or a damaging program, it attempts to make the change to the virtual operating system. The change to the VM alerts the software, which then terminates the file, informs the user that a threat was found, and deletes that instance of the virtual environment altogether.

Every time the user opens a PDF, a brand-new instance of the virtual machine is created to ensure the user always starts from a clean system.

The software also collects detailed security forensics data, such as the source of the file, the changes it made to the virtual system, and what it tried to do online or on the network. The data can be used by IT managers or another security product to understand the threat.

Even Adobe acknowledged the importance of sandboxing, as it introduced Protected Mode in its latest Adobe Reader X. Under Protected Mode, PDF processes such as PDF and image parsing, JavaScript execution, font rendering and 3D rendering happens in the sandbox, said Adobe.

According to Ghosh, however, Protect Mode will not prevent unauthorized read access to the file system or registry, restrict network access, or prevent reading or writing to the clip board, so some threats still remain.

Microsoft has also added sandboxing to Office, and Google implemented it into its Chrome browser.

The Invincea Document Protection is an optional extension to the company’s Invincea Browser Protection software. With the Browser Protection, the Web browser runs in a virtual environment, allowing users to browse the Web without any risk to their computers. Any downloaded malware makes changes to the virtual machine, and when the browser is closed, the virtual instance is deleted, removing any changes.

While a few years ago, creating a virtual appliance on the desktop may have taxed user hardware, Ghosh said modern hardware generally come with sufficient memory and have a fast enough processor to easily handle Invincea’s security appliance.