PDF files under attack
67777
Day after Adobe patches Acrobat, Russian exploits target vulnerable systems.
526426
It may be a single malicious user with an axe to grind, and that user may be targeting a very small group of people who just happen to use Microsoft Excel. But whoever it is continues to make security firms like Symantec nervous, as yet another Excel-based document with a malformed image string, dubbed Trojan.Mdropper.Y, has turned up.
22385
Directory transversal shocker A scripting error in Adobe's website gave outsiders broad access to internal files on the company's webserver that could prove valuable to malicious hackers trying to penetrate its security.â¦
387344
On 20 November 2004, a major malicious-code attack emerged targeting European Web sites via banner ads. This two-step attack exploits two previously identified security vulnerabilities: the Bofra (or IFRAME
112014
PC Magazine - A malicious PDF is exploiting a URL-handling flaw in Windows XP and Windows Server 2003 running IE7.
224283
Trojan horse that exploits flaw in how Windows handles JPEG images may be low risk, but it's a bad omen.
121787
A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net.
424521
The software maker has acknowledged it was wrong when it told users certain file formats were insecure.
30517
The first malicious codes to exploit security flaws in Microsoft Windows&#39; handling of jpeg image files has appeared on internet newsgroups.
301321
(InfoWorld) - Security vendors and users agree that image spam is finally on the decline, but at the same time a new kind of spam is emerging that uses an attached PDF file to trick recipients into buying stock in a company. Image spam, which has plagued antispam filters for the past year, is finally on the decline as e-mail security vendors have tweaked their products to block it, says Paul Henry, vice president of technology evangelism withÂ Secure Computing.Â Image spam has long fooled filters because the message's text is embedded in an image found in an e-mail's body, and filters until recently couldn't decipher images. At the beginning of July it comprised about 38 percent of all spam and is now down to about half that volume, says Henry.Stats from Symantec also show the volume of image spam, which the company says began to decline in May, has continued to shrink from its all-time high of 52 percent of all spam sent in January. "Image spam does seem to be decreasing ... Antispam software, RBLs [real-time black lists] and other filtering techniques have done a good job at decreasing the previous spammers' attempts; it is now time for them to find a new avenue to annoy us," says Jim DeSantis, enterprise messaging architect with Abhir Technical Consulting. Beginning to take image spam's place is PDF spam, where the spammer sends an e-mail message with a PDF attached -- which most spam filters can't read -- that attempts to convince the recipient to purchase stocks. So far security vendors are reporting two types; a professional-looking PDF of a newsletter pumping a German company's stock that security companyÂ IronPort saysÂ was sent more than 5 billion times in its first few days, and a more rudimentary PDF attachment containing text that pumped a stock which Symantec says was sent to more than 30 million users over a 10-day period in late June. So far, PDF spam isn't approaching the volumes that image spam has enjoyed -- Secure Computing's Henry says in early July it accounted for about 4 percent of all spam sent -- yet this new spam trick could prove to be significantly more malicious. Henry says proof-of-concept code exists that demonstrates security vulnerabilities in PDF files, which means PDF spam could carry malware that is secretly downloaded on the recipient's PC. Image spam was only dangerous to those recipients who bought the stock that messages were touting and likely lost money on it. "I haven't seen any malware yet in PDF spam ...but I'm keeping my eye on it," Henry says. PDF spam does hold some potential for spammers who are advanced enough to take advantage of the technology, some say. "Simply attaching a PDF to an e-mail and randomizing the size and name of the title, to me, does not seem all that impressive, but it seems to be working," says Kyle Ohme, director of technology with W3i.com, an interactive marketing services provider. "I'm interested to see how far this will go, as some may start to use some of the more advanced functions of Adobe to place beacons and other tracking mechanisms that have become limited in the past years," Ohme says. Malware-laden or not, PDF spam is an example of how spammers will continue to innovate in order to get their messages across. "The battle between spammers and spam-filter vendors will always be a game of cat and mouse. The tools are definitely getting smarter ... the better the tools the more creative spammers will be," says Sharon Finney, information security administrator with Dekalb Medical Center in Decatur, Ga. "I am seeing some increases in PDF spam, but no real volume yet. All spam is a nuisance regardless of the technology behind it. I don't think that any one type of spam is more of a nuisance than any other." Â
415502
You'll want it but we can't tell you why Adobe has pushed out a stealthy - but important - update to its Reader software that fixes a number of unspecified security problems.â¦
49531
Microsoftâs monthly security bulletin has uncovered a âcriticalâ buffer overrun vulnerability that exists in the processing of JPEG image formats.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
22770
Unpatched Windows machines are vulnerable to latest adware attack
23136
The hacker who discovered a recently patched QuickTime flaw affecting the Firefox browser says he has found an equally serious flaw in Adobe Systems Inc.&#39;s PDF file format.
266699
What happened to the guts in mainstream publications? I recall back in the 80s InfoWorld pressured Lotus into ditching its copy protection scheme by docking Lotus 1-2-3 several points in reviews because of the inconvenience. I believe Lotus was the first to buckle, but other vendors jumped on the bandwagon and abandoned copy protection. Fast forward to today. Not only has copy protection come back from the grave, it has risen like a juggernaut zombie bent on eating everyone's brains. Worse, many consumers and writers alike seem to be unscrewing their scalps and willingly offering up the meal. "I want the latest iThing, it's so cool!" Sure, you'll find appropriate outrage in Linux Journal and a handful of renegade publications like the Register. But what happened to the mainstream journals with the guts of yesteryear?
221404
Millions of computer users are at risk of attack because flaws in the way Windows handles some images.