So earlier this month there was a major Adobe hack and the source code for a couple of it’s mainstream products (Acrobat Reader, ColdFusion and ColdFusion Builder) was leaked and downloaded, most likely in it’s entirety.
There was a bit of a panic surrounding this as the software is used by a lot of major governmental agencies (especially in the US), and it’s feared that when someone with malicious intent has access to your source code – they are more likely to be able to find previously undiscovered vulnerabilities.
The attack also leaked 2.9 million customer records including names and credit card numbers, so much for Adobe doing cloud right.
Adobe’s systems have been hit by numerous “sophisticated attacks” that have compromised the information of 2.9 million customers, and accessed the source code of Adobe products.
The company said on Thursday that it has been the victim of a major cyberattack and said hackers had accessed those millions of customer IDs and encrypted passwords.
“We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders,” the company said.
It does not believe decrypted credit or debit card numbers were accessed.
“As a precaution, we are resetting relevant customer passwords to help prevent unauthorized access to Adobe ID accounts. If your user ID and password were involved, you will receive an email notification from us with information on how to change your password,” the company wrote.
The company says people should change their passwords on any other website where they have used the same user ID and password. But you’d do that anyway, wouldn’t you?
Now whilst that studying the source code may give you some advantages, Acrobat for example has over 13 million lines of code – so you’d basically looking for a needle in a haystack.
Also the fact the software has a bunch of security measures built in like address space layout randomization (ASLR), a sandbox (which logically separates any opened PDF file), and the broker process (basically a firewall between the process and system calls) – means even if you do find a vulnerabilty, crafting an exploit from it is going to be really hard.
We haven’t as yet seen any zero day exploits that could have come from the compromise, but it doesn’t mean they aren’t out there – or being used for targeted attacks/cyberterrorism.
It is “in the process” of notifying customers whose credit or debit data may have been stolen, and is offering them condolence in the form of a “one-year complimentary credit monitoring membership where available.”
Where we come from, that’s called offering free stable doors after the horses have bolted.
The company has also contacted federal law enforcement officials and notified banks that process customer payments for Adobe.
Hackers have also accessed the source code for the company’s Adobe Acrobat, ColdFusion, ColdFusion Builder, and other unnamed products, the company said in a separate blog post.
Security firm Hold Security claims to have found 40 gigabytes in encrypted archives on a hacker’s server, apparently containing source code on some of Adobe’s biggest products.
“This breach poses a serious concern to countless businesses and individuals,” Hold Security wrote. “Effectively, this breach may have opened a gateway for new generation of viruses, malware, and exploits.”
Although I don’t really think they are related, it just happens that ColdFusion servers are very frequently setup without all the extra security controls that Adobe provides being enabled.
Source: The Register
- The Logjam Attack – ANOTHER Critical TLS Weakness
- WordPress Critical Zero-Day Vulnerability Fixed In A Hurry
- Commix – Command Injection Attack Tool
- Serious Vulnerability In Adobe ColdFusion Application Server
- Hackers Target 0-Day Vulnerability In Adobe PDF Reader & Acrobat
- Adobe Promises Patch For Flash 0-day Being Used In Targeted Attacks
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 230,691 views
- AJAX: Is your application secure enough? - 119,545 views
- eEye Launches 0-Day Exploit Tracker - 85,230 views