Topic 'Open a pdf in browser vs in application' in forum 'Security' - dslreports.com

Re: Open a pdf in browser vs in application

Fri, 25 Jan 2013 21:51:21 EDT

Zee5tH posted : Thank you very much.I will try Sandboxie.If I have any questions I will post them. :)

Re: Open a pdf in browser vs in application

Fri, 25 Jan 2013 00:44:17 EDT

balloonshark posted : You can have a look at Sandboxie here. »www.sandboxie.com/
--
If we quit voting, will they all just go away?

Re: Open a pdf in browser vs in application

Thu, 24 Jan 2013 22:39:12 EDT

Zee5tH posted : Where can i get Sandboxie from? Please excuse that I am not familiar with this program.

Re: Open a pdf in browser vs in application

Wed, 23 Jan 2013 23:32:27 EDT

Cronk posted :

said by Blackbird
Doesn't Chrome have a built-in pdf plug-in viewer that you have to manually disable to stop in-browser viewing? (in the address bar, enter about:plugins > locate Chrome pdf viewer > click Disable)
[/BQUOTE :

OK I'll look into that when I get back on that machine. Thanks

Re: Open a pdf in browser vs in application

Wed, 23 Jan 2013 09:11:46 EDT

balloonshark posted : If by personal information you mean files on your computer you could set up Sandboxie to do this. I use Sandboxie to isolate my internet facing programs from the rest of my computer. When I open my browser it is "sandboxed" and anything I open with it such as a pdf would open and sandbox my pdf reader.

I can also set restrictions as to what can open and have internet access in the sandbox. It's also possible to restrict access to files, folders or partitions by anything running in that sandbox.

Sandboxie is often overlooked but I wouldn't surf without it. My other layers include an AV and 2 on-demand scanners. I also run a HIPS program to alert me in the off chance anything would run without my permission. Recent backups of data are also important.
--
If we quit voting, will they all just go away?

Re: Open a pdf in browser vs in application

Tue, 22 Jan 2013 22:16:02 EDT

Zee5tH posted : Hi I agree with your philosophy on layered security,what I would like to know first of all I have 2 pc's with Win 7 Home Premium and 2 with XP3.I would like to know which is the better pdf reader Adobe (Current VS)or Fox it.I have both on my default browser Firefox(the latest version),with the plugins disabled.My question is if you go the layered route there are some Brokerage sites that offer research on certain things.I have not gone to the research section since these exploits came out in Adobe or Fox it.I don't want to lose my personal information by opening one of these pdf reports they offer,is there a safe way of opening many research reports in a layered way without giving up any of my info.I hope I explained this the right way.
Thank you.

Re: Open a pdf in browser vs in application

Tue, 22 Jan 2013 19:07:49 EDT

Mele20 posted : Foxit has too many problems. You are better off with something like Evince which is a Linux PDF reader that has been ported to Windows. Of course, read outside the browser. Or, the next version of Fx will have builtin PDF reader using HTML5.

»projects.gnome.org/evince/

»www.pcworld.com/article/2025153/···ers.html
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

Re: Open a pdf in browser vs in application

Tue, 22 Jan 2013 18:00:06 EDT

Phoenix22 posted : OMG!

Re: Open a pdf in browser vs in application

Tue, 22 Jan 2013 10:18:16 EDT

Blackbird posted :

said by Cronk:

I've just installed FoxIt reader on a Vista machine. During install I de-selected the browser plugins and told it do not open pdf's in the browser when it asked me. Yet when I am using Chrome, pdf files still open in the browser. Any ideas?

Doesn't Chrome have a built-in pdf plug-in viewer that you have to manually disable to stop in-browser viewing? (in the address bar, enter about:plugins > locate Chrome pdf viewer > click Disable)
--
�The American Republic will endure until the day Congress discovers that it can bribe the public with the public's money.� A. de Tocqueville

Re: Open a pdf in browser vs in application

Tue, 22 Jan 2013 10:09:22 EDT

Cronk posted : I've just installed FoxIt reader on a Vista machine. During install I de-selected the browser plugins and told it do not open pdf's in the browser when it asked me. Yet when I am using Chrome, pdf files still open in the browser. Any ideas?

Thanks

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 14:38:44 EDT

Blackbird posted :

said by mysec:

... Note, however, that there is a social engineering component to this exploit:

Italian security researcher Andrea Micalizzi discovered that the latest version of the software crashes if users are tricked into clicking on an overly long web link.

----
rich

Much real-world digital maliciousness relies on multiple factors for success, just one of which is social engineering. This is one of the realities that complicates the analysis of a computer exploit event or the prevention of similar attacks against other computer owners. Your software can be fully patched, yet one oops in "safe hex" habits and trouble may loom. Likewise, you can be as "safe hex" careful as humanly possible, but leave some program on a system unpatched and trouble may loom. And so on... Watching posts in this forum over time, one becomes highly aware of just how many ways the various exploit factors interplay to both cause confusion and to make nearly impossible any simple, one-size-fits-all solution to preventing infections.
--
�The American Republic will endure until the day Congress discovers that it can bribe the public with the public's money.� A. de Tocqueville

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 14:02:52 EDT

mysec posted :

said by Lagz:

Yep. Sadly there is no fix or update for social engineering. :D

I'm going make a note of that!

----
rich

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 13:37:59 EDT

Lagz posted :

said by mysec:

said by Lagz:

In the recent Foxit plugin vulnerability, it was the plugin that was at fault and not Foxit reader directly.

Thanks for that update! More reason to keep the plugin disabled.

Note, however, that there is a social engineering component to this exploit:

Italian security researcher Andrea Micalizzi discovered that the latest version of the software crashes if users are tricked into clicking on an overly long web link.

----
rich

Yep. Sadly there is no fix or update for social engineering. :D
--
When somebody tells you nothing is impossible, ask him to dribble a football.

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 13:31:47 EDT

mysec posted :

said by Lagz:

In the recent Foxit plugin vulnerability, it was the plugin that was at fault and not Foxit reader directly.

Thanks for that update! More reason to keep the plugin disabled.

Note, however, that there is a social engineering component to this exploit:

Italian security researcher Andrea Micalizzi discovered that the latest version of the software crashes if users are tricked into clicking on an overly long web link.

----
rich

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 12:13:37 EDT

Lagz posted : To focus on something Blackbird was saying in an earlier post about extra layers of vulnerability. In the recent Foxit plugin vulnerability, it was the plugin that was at fault and not Foxit reader directly.
»www.theregister.co.uk/2013/01/11···in_vuln/

But the bug is not triggered by a booby-trapped document, which is the usual way of infecting systems running insecure PDF readers. Instead, clicking on a link to any PDF that deliberately includes a very long query string after the filename causes a buffer overflow in the Foxit plugin.

Whether that's currently being exploited on a particular malware site currently or not shouldn't be at issue, but the fact that even the plugins themselves add potential vulnerability.
--
When somebody tells you nothing is impossible, ask him to dribble a football.

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 11:29:58 EDT

mysec posted :

said by Cronk:

I'm referring to whether there is any added risk as a result of going through the browser. The inability to do multiple manual scans is not in the picture here since the users in question would not ever scan first anyway.

Does opening it in the browser create the possibility that the exploit will be able to poke for vulnerabilities in the browser, that would otherwise not have been exploitable if the pdf was opened in the application?

The current PDF exploits that are part of the Exploit Kits hosted on malware sites one may likely encounter via some type of redirection, aren't looking for vulnerabilities in the browser, rather, in the PDF application itself.

Therefore, whether the PDF file is opened automatically via a browser plug-in, or manually by a user, the exploit code will run, if the PDF Reader isn't patched for that particular vulnerability.

Here is some typical download code in a booby-trapped PDF file:

[att=1]

[att=2]

Again, if the PDF Reader is not patched against a particular vulnerability, then the download will occur automatically and the user potentially will be infected, barring some other security measure blocking the download.

The safety measure in having the PDF plug-in disabled, or whitelisted for certain sites, is that the exploit code on the malware site that triggers the download will cause the browser to alert the user:

[att=3]

If the user's policy is not to download anything that she/he hasn't gone looking for, the user will cancel the prompt and move on -- exploit fails.

----
rich

Re: Open a pdf in browser vs in application

Fri, 18 Jan 2013 10:10:33 EDT

Cronk posted : OK thanks.

Re: Open a pdf in browser vs in application

Tue, 15 Jan 2013 20:01:52 EDT

Blackbird posted :

said by Cronk:

...

said by Blackbird:

..using a plug-in (which in turn invokes the application program itself) within the browser add two more layers of potential security vulnerability ahead of the app alone.

although I can't say I understand the two layers he refers to. Does opening it in the browser create the possibility that the exploit will be able to poke for vulnerabilities in the browser, that would otherwise not have been exploitable if the pdf was opened in the application?

The browser must communicate with the plug-in and the plug-in communicates with its related app which then ostensibly communicates with the target file. Those extra two layers of data exchange and interface with the OS (browser/plugin and plugin/app) establish at least the possibility for things like unchecked buffer overflows plus who-knows-what other possible hiccups that some creative hackers might discover. Even if the app itself is airtight, there are two added levels for mischief to occur when viewing through the browser... though that's not to say both added levels are equally vulnerable or are easy to code an exploit for. But they do stand as added code that can be messed with... and I prefer to keep all that to a minimum by simply downloading the file, scanning it several ways, and opening it directly with the app of choice.
--
“The American Republic will endure until the day Congress discovers that it can bribe the public with the public's money.” A. de Tocqueville

Re: Open a pdf in browser vs in application

Tue, 15 Jan 2013 16:34:02 EDT

Cronk posted : I'm referring to whether there is any added risk as a result of going through the browser. The inability to do multiple manual scans is not in the picture here since the users in question would not ever scan first anyway.

Blackbird touched on the risks I am asking about when he said:

said by Blackbird:

..using a plug-in (which in turn invokes the application program itself) within the browser add two more layers of potential security vulnerability ahead of the app alone.

Re: Open a pdf in browser vs in application

Tue, 15 Jan 2013 16:12:34 EDT

jaykaykay posted : Does anyone know if Nitro is affected? I normally don't open pdf. files in my browser, but nother person who uses this system does.

Re: Open a pdf in browser vs in application

Tue, 15 Jan 2013 11:58:37 EDT

StuartMW posted : »Adobe Reader display PDF in Browser?

»'Better than Adobe' Foxit PDF plugin hit by worse-than-Adobe
--
Don't feed trolls--it only makes them grow!

Re: Open a pdf in browser vs in application

Tue, 15 Jan 2013 11:56:24 EDT

Blackbird posted : From my perspective, opening a pdf (or any other data/document file) from within a browser at a minimum means I can't scan it with multiple anti-malware tools as I normally do before exposing my system to its contents. To me, layered security means not trusting in simply one layer such as just a live AV that can miss something, especially almost-new exploits. Another thought is that using a plug-in (which in turn invokes the application program itself) within the browser add two more layers of potential security vulnerability ahead of the app alone. However, I realize that many users will trade off the speed and convenience of in-browser viewing versus the downloading/extra-scanning time and effort that provide the increased security. For a lot of users, convenience always trumps security... which is one reason why so many users' computers get infected.
--
“The American Republic will endure until the day Congress discovers that it can bribe the public with the public's money.” A. de Tocqueville

Open a pdf in browser vs in application

Tue, 15 Jan 2013 10:18:20 EDT

Cronk posted : Is it more risky to open a pdf document in a browser, using a plugin, as opposed to disabling the plugin and opening it in an application like Adobe Reader or Foxit? If so, what makes it more risky? Thanks