Windows needs a built-in PDF viewer, argues researcher
A built-in viewer from Microsoft or or a stripped-down viewer from Adobe would protect users from some PDF exploits, F-Secure researcher says
Microsoft should add a basic PDF viewer to Windows to help protect users from the spike in attacks exploiting bugs in Adobe's Reader, a security researcher said Friday.
"Apple does this with its Preview [application], and Microsoft should, too," said Sean Sullivan, a security advisor with Finnish antivirus vendor F-Secure's North American operation. "I just want to view and read PDFs. I don't want to listen to them or watch them or launch executables from them or run JavaScript," Sullivan added, referring to several advanced features that Abobe's own PDF viewer, the for-free Reader, supports.
[ Master your security with InfoWorld's interactive Security iGuide. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]
Some of those features, including Reader's support of JavaScript and the PDF specification's support for the /Launch function, have been exploited by attackers in increasing numbers since 2008. According to tallies by antivirus vendor McAfee, PDF exploits were up more than eight times in 2009 compared to the year before, a trend that has continued into 2010.

And the /Launch function, which allows PDF documents to run embedded executable files, is currently being exploited by attackers in a widespread malicious message campaign that tries to trick users into opening a rigged PDF.
Sullivan spelled out his case in more detail in a post to the F-Secure security blog on Thursday. "Your customers are tired of the exploits and the complications that so many of today's PDF readers include," said Sullivan in a "Dear Microsoft" missive.
"They should write a really simplified viewer, one that just previews PDF," Sullivan added Friday in a telephone interview. "They don't even need to build it into the operating system. They can make it an optional download like they did the 'Save As PDF' add-in for Office."










