Nearly six out of every 10 users are running an outdated version of Adobe Reader, leaving them highly vulnerable to PDF-based attacks, according to Avast Software. The anti-malware vendor analyzed the users who had avast antivirus installed on the computers and found that more than half of the users with Adobe Reader had an outdated and vulnerable version of the software, the company said. To be clear, that’s not 60 percent of all the users running avast but 60 percent of avast users who happen to have Adobe Reader installed.
That seems like a really fine distinction to draw, except Avast found that only 80 percent of its users run Adobe Reader. Foxit commanded about five percent user share and the remaining 15 percent either didn’t have a PDF reader or ran some other program.
“Attackers go where the users are,” David Lenoe, head of Adobe’s product security incident response team, told eWEEK during a briefing in June, noting that Reader and Acrobat are one of the most popular software programs in the world.
As for Avast, 60 percent of users with Adobe Reader is significant, and the breakdown reveals more interesting facts. Most of the users are running version 9, followed by version 8. There were even users still running version 3, which dates back to 1996. Considering that cyber-attackers regularly target Web browsers, Microsoft Office applications and Adobe software, including Acrobat, Reader and Flash Player, running such an old version is just asking to be attacked.
“There is a basic assumption that people will automatically update or migrate to the newer version of any program,” said Ondrej Vlcek, CTO at AVAST Software, noting that assumption appears to be wrong with Adobe Reader.
Attackers regularly attach maliciously constructed PDF files to email messages and trick users into opening the file. While some of these rogue PDF files may exploit a zero-day vulnerability, more often than not, the malware writers are targeting well-known security flaws Adobe has already patched, knowing that many users wouldn’t have updated their software.
With the introduction of sandboxing technologies in Reader X, the number of attacks has dropped dramatically, Lenoe said, but attackers continue to target older programs.
With this number in mind, it makes even more sense why Adobe is rolling out the automatic update option to its Acrobat and Reader users. There are just too many users out there who are not upgrading when prompted to and too many users whose vulnerability may potentially result in their work network being compromised.
Some enterprises prefer testing all updates to ensure there are no conflicts with all the other applications installed, Lenoe said. For those organizations, automatic updates will not make sense, but for most users, automatic updates will help make sure people are all up-to-date, Lenoe said.
Users should run Adobe Reader X since its sandbox technology has shown several times this spring at how well it is able to contain malware exploiting various zero-day vulnerabilities and keep the users safe. If for any reason they can’t upgrade to X, they should at least run versions 8 and 9, since Adobe continues to regularly release security updates for those versions as well.
Many security companies, including F-Secure, recommend that users run alternative PDF readers instead of Adobe Reader. Users of other PDF Reader packages, such as Foxit, are generally safe for the time being because attackers haven’t customized their attacks to those programs yet.
PDF files can launch executables and run JavaScript. These are features that most legitimate documents will never use, but are perfect attack vectors for malicious perpetrators. “It’s no wonder there are regular security problems with PDF readers in general,” wrote Mikko Hyponnen, chief research officer at F-Secure.
For those 40 percent of avast users with Adobe software who are running fully patched versions of Adobe Reader or had Adobe Reader X, keep up the good work.