Major Adobe Hack – Acrobat & ColdFusion Source Code Leaked

Use Netsparker


So earlier this month there was a major Adobe hack and the source code for a couple of it’s mainstream products (Acrobat Reader, ColdFusion and ColdFusion Builder) was leaked and downloaded, most likely in it’s entirety.

There was a bit of a panic surrounding this as the software is used by a lot of major governmental agencies (especially in the US), and it’s feared that when someone with malicious intent has access to your source code – they are more likely to be able to find previously undiscovered vulnerabilities.

The attack also leaked 2.9 million customer records including names and credit card numbers, so much for Adobe doing cloud right.

Adobe’s systems have been hit by numerous “sophisticated attacks” that have compromised the information of 2.9 million customers, and accessed the source code of Adobe products.

The company said on Thursday that it has been the victim of a major cyberattack and said hackers had accessed those millions of customer IDs and encrypted passwords.

“We also believe the attackers removed from our systems certain information relating to 2.9 million Adobe customers, including customer names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders,” the company said.

It does not believe decrypted credit or debit card numbers were accessed.

“As a precaution, we are resetting relevant customer passwords to help prevent unauthorized access to Adobe ID accounts. If your user ID and password were involved, you will receive an email notification from us with information on how to change your password,” the company wrote.

The company says people should change their passwords on any other website where they have used the same user ID and password. But you’d do that anyway, wouldn’t you?

Now whilst that studying the source code may give you some advantages, Acrobat for example has over 13 million lines of code – so you’d basically looking for a needle in a haystack.

Also the fact the software has a bunch of security measures built in like address space layout randomization (ASLR), a sandbox (which logically separates any opened PDF file), and the broker process (basically a firewall between the process and system calls) – means even if you do find a vulnerabilty, crafting an exploit from it is going to be really hard.

We haven’t as yet seen any zero day exploits that could have come from the compromise, but it doesn’t mean they aren’t out there – or being used for targeted attacks/cyberterrorism.


It is “in the process” of notifying customers whose credit or debit data may have been stolen, and is offering them condolence in the form of a “one-year complimentary credit monitoring membership where available.”

Where we come from, that’s called offering free stable doors after the horses have bolted.

The company has also contacted federal law enforcement officials and notified banks that process customer payments for Adobe.

Hackers have also accessed the source code for the company’s Adobe Acrobat, ColdFusion, ColdFusion Builder, and other unnamed products, the company said in a separate blog post.

Security firm Hold Security claims to have found 40 gigabytes in encrypted archives on a hacker’s server, apparently containing source code on some of Adobe’s biggest products.

“This breach poses a serious concern to countless businesses and individuals,” Hold Security wrote. “Effectively, this breach may have opened a gateway for new generation of viruses, malware, and exploits.”

You can see the original posts by Adobe here – Important Customer Security Announcement & Illegal Access to Adobe Source Code.

We’ll have to wait and see if anything actually comes from it. There were a few nasty compromised earlier this year that were ColdFusion based, such as Linode & NW3C.

Although I don’t really think they are related, it just happens that ColdFusion servers are very frequently setup without all the extra security controls that Adobe provides being enabled.

Source: The Register

Posted in: Exploits/Vulnerabilities, Web Hacking

, , ,


Latest Posts:


RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.
NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.
Metta - Information Security Adversarial Simulation Tool Metta – Information Security Adversarial Simulation Tool
Metta is an information security preparedness tool in Python to help with adversarial simulation and assess security defense preparation and alerts.
Powershell-RAT - Gmail Exfiltration RAT Powershell-RAT – Gmail Exfiltration RAT
Powershell-RAT is a Python-based Gmail exfiltration RAT that can be used a Windows backdoor to send screenshots or other data as an e-mail attachment.
SCADA Hacking - Industrial Systems Woefully Insecure SCADA Hacking – Industrial Systems Woefully Insecure
It seems like SCADA hacking is still a topic in hacker conferences, and it should be with SCADA systems still driving power stations, manufacturing plants etc.
airgeddon - Wireless Security Auditing Script airgeddon – Wireless Security Auditing Script
Airgeddon is a Bash powered multi-use Wireless Security Auditing Script for Linux systems with an extremely extensive feature list.


Comments are closed.