Malicious PDF Documents can be a threat to your business
I can't tell you how many people tell me that they never worry about clicking on Adobe PDF file documents because "they are safe". They are shocked when I tell them that infected PDF files is one of the major ways viruses and trojans are brought into a business. You should always make sure you have your Adobe Reader updated to the latest update level for the version you have. If you are at Adobe Reader versions 4, 5, 6, or 7, you should immediately plan on updating to the current version. If you are at Adobe Reader versions 8 or 9, you should first make sure your Adobe Readers are updated to the patch levels for those versions, then test your PDF applications with Adobe Reader X and plan on upgrading as soon as practical. Adobe Reader X is the most current version.
If you are for some reason using an alternative PDF reader to Adobe's products, they are not immune from PDF security issues. You should check with your vendor on what their current version and patch recommendations are for their products and follow their recommendations.
Two simple security changes to better protect you
Besides getting your Adobe Readers to the most current updates (or hopefully the most current version) you can also change two simple settings inside Adobe Reader to improve your PDF security in the future.
Start Adobe Reader. Then click Edit along the top menu. Now select Preferences at the very bottom of that drop down menu.
At the very bottom of the left menu select "Updater". Now on the right side select "Automatically Install Updates". Now click OK on the bottom right. This tells Adobe to automatically check for security updates for this version of Adobe Reader. Please realize that users who do not have full rights to their computers cannot automatically update Adobe Reader without the Administrator (or equivalent account).
Adobe Reader defaults to allow a PDF document to launch an external program. This is the way many malicious PDF files attempt to infect your computer. You should turn off this default setting. From that same Preferences menu select Trust Manager on the left side and then on the right side uncheck the "Allow opening of non-PDF file attachments with external applications". Now click OK on the bottom right. This setting does not require any additional rights to work. It protects everyone.
How do I keep Adobe updated for users who have limited rights?
Updating software for users with limited rights is one of the greatest technical challenges. Many simply give in and make everyone "administrator". While this solves the immediate problem, it opens you up to a myriad of other threats. As a best practice, we would recommend against the urge to just let everyone do anything they want to their machines. This will surely cause you pain down the road. CSI has tools that can assist and even automate updating machines properly without weakening your overall network security inside your business. We'd be happy to discuss with you how we can tackle this and other similar security update issues you may have in a way. Contact us for more information.
What about Apple Macintosh computers?
Macintosh users are not immune to this issue. In fact Computerworld recently reported that a new malware product is targeting the Mac via PDFs. Apple is updating the signature of their bare bones antivirus in their Mac OS X to block this threat.
Leave a comment!
You must be logged in to post a comment.