Adobe is one of the most popular software used around the globe. The company recently ramped up the security of Adobe Reader by introducing a sandbox feature. However, apparently hackers have found a way to sidestep the sandbox and exploit the software.
The earlier versions of Adobe Reader have been fairly prone to security loopholes. But in more recent versions, Adobe has been able to enhance the security and fend off potential hackers with the help of the sandbox feature.
The feature essentially allows the user to run a given Adobe application in a protected mode, thus fending off any potential zero-day exploits. Used both in Adobe 10 and 11, the feature has indeed made Adobe applications a lot more safer than before.
However, a forensics firm, Group-IB, has now revealed that Adobe’s sandbox feature may not be as secure as it seems. According to the firm, they have discovered that a zero-day exploit is currently available in the cybercriminal underground. This exploit is able to bypass the sandbox security of Adobe 10 and 11 and compromise the security of the machine running them.
Currently, the exploit is being sold for as much as $50,000 by cybercriminals. However, the exploit can’t be executed until a user exits a browser session or closes the Reader.
Thankfully, Adobe has been quick to respond to the revelations made by Group-IB. According to an Adobe spokesperson, Wiebke Lips, “Adobe will reach out to Group-IB. But without additional details, there is nothing we can do, unfortunately— beyond continuing to monitor the threat landscape and working with our partners in the security community, as always.”
Courtesy: KrebsOnSecurity
[ttjad keyword=”adobe-software”]
