On February 19th, Adobe confirmed reports that its version 9 software of Adobe Acrobat and Adobe Reader were vulnerable to buffer overflows that have allowed some companies to be targeted in spearphishing attacks.

Their announcement said:

A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe is planning to release updates to Adobe Reader and Acrobat to resolve the relevant security issue. Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Updates for Adobe Reader 8 and Acrobat 8 will follow soon after, with Adobe Reader 7 and Acrobat 7 updates to follow. In the meantime, Adobe is in contact with anti-virus vendors, including McAfee and Symantec, on this issue in order to ensure the security of our mutual customers.

McAffee’s Avert Lab Blog has screenshots of the buffer overflow in action here. They go on to say:

Needless to further remind everyone, zero-day attacks are the preferred choice of cyber criminals and will continue to be so in 2009. If the recent W32/Conficker.worm (MS08-087) and Exploit-XMLhttp.d (MS08-078, MS09-002) were not good enough to prove our point, here is another one.

As a reminder, the Better Business Bureau phishing scam successfully exploited many large companies last year by sending emails with malicious .PDF attachments to executives of those companies. And since there will not be a patch in place until Mid-March, extra vigilance is required to prevent this exploit from affecting you.

Zero Day exploits don’t typically remain targeted against just a few enterprises for long. Within days we expect this exploit to accompany broader mass phishing attempts. And given the IRS tax season, perhaps malicious .Pdf’s will be seen targeting taxpayers via email.

A senior Unix administrator known only as “SK” admitted she got lucky when she found the malicious script planted in a development server on the network.  “The malicious script was at the bottom of the legitimate script, separated by approximately one page of blank lines, apparently in an effort to hide the malicious script within the legitimate script,” states an affidavit filed against Rajendrasinh Makwana, an Indian citizen living in the United States under a work visa.  Makwana is accused of illegally accessing Fannie’s network after being fired from the job. Had the script executed as planned, 4000 servers at Fannie would have been wiped clean tomorrow, January 31st.

According to an InformationWeek article here:

The discovery occurred on Oct. 29. Makwana had been terminated as a Fannie Mae contractor on Oct. 24, around 1 or 1:30 p.m., the affidavit says, but his network access was not terminated until late that evening. Makwana was fired for allegedly creating a computer script earlier that month that changed server settings without the permission of his supervisor.

Makwana was not required to turn in his badge or Fannie Mae-supplied laptop until the end of the day on Oct. 24. According to Nye’s affidavit, it was during that afternoon that Makwana is alleged to have planted the malicious script.

Makwana had planted his script by using his existing credentials over an encrypted channel.  Since his accounts were still active and his access rights still in place, no technological solution could have prevented or stopped such an attack.  But it clearly highlights the threats posed by internal users.

Information security is sometimes more about enforcing procedures than policies.  In Makwana’s case, the policies were followed for a termination in that accounts were disabled by the end of the employee’s last working day, but the procedures perhaps could have included building security escorting the employee and  the timely confiscation of corporate equipment.

Everyone wants to trust their employees as friends and colleagues.  And enforcing a procedure that requires a security guard to watch the employee pack his things and turn in building passes, credentials, laptops, phones, and other personal items just makes your company look like a cruel, bullying entity.  However, not following such a process could jeopardize your data.