Safe security-wise to use Chrome as default PDF reader?

[nine9s]

I have been reading reports of Adobe Reader exploits. Since I only read PDFs and do not need any extra options or anything, I am satisfied just using Chrome to read PDFs. I uninstalled Adobe Acrobat reader and linked PDF files to be opened by Chrome.

I have no PDF addons on Chrome so it just using the native ability of Chrome to read PDF files. I would think this is safe but I want to make sure there are no security concerns doing this over Adobe Reader or any dedicated PDF reader program?

Would it be better security-wise to use Adobe Reader or is Chrome safer?

 

[redbleed]

I recommend using firefox's addon "pdf download". You can disable or enable it at will.

I've used chrome and I'm not sure how much google tracks your browsing activity through it. I know in firefox, websites you visit get sent to a google repository to check for safety. In about:config, you can search for this "safebrowsing" feature and disable it if you want.

 

[blankslate]

Maybe look into Foxit Reader?

seems like a reasonable alternative to Adobe Reader.

 

[mechBgon]

Maybe look into Foxit Reader?

seems like a reasonable alternative to Adobe Reader.

Security-wise, I'd take Adobe Reader 11 (with a custom configuration that disables seldom-used capabilities, e.g. Adobe JavaScript, and enforces Protected View by default) over Foxit. Adobe's sandboxing efforts have paid off. Here's an easy settings guide: http://www.winhelp.us/index.php/general-security/application-security/securing-adobe-reader.html

Myself, I use the native PDF reader in Win8, which runs in an AppContainer for security containment, and doesn't have piles of over-the-top features to abuse. Sometimes less is more. It also updates via Windows Update, one less thing for me to babysit.

 

[lxskllr]

I don't like reading PDFs in the browser, regardless of security concerns. My preference is Evince for a standalone reader. It's a little big, but it works well, and is libre software. No crapware addons or toolbars try to install when you install it.

http://projects.gnome.org/evince/

 

[blankslate]

Security-wise, I'd take Adobe Reader 11 (with a custom configuration that disables seldom-used capabilities, e.g. Adobe JavaScript, and enforces Protected View by default) over Foxit. Adobe's sandboxing efforts have paid off. Here's an easy settings guide: http://www.winhelp.us/index.php/general-security/application-security/securing-adobe-reader.html

Myself, I use the native PDF reader in Win8, which runs in an AppContainer for security containment, and doesn't have piles of over-the-top features to abuse. Sometimes less is more. It also updates via Windows Update, one less thing for me to babysit.

http://arstechnica.com/security/2012/11/zero-day-attack-reportedly-pierces-key-adobe-reader-defense/

Well you maybe better off with the Win8 reader than either Foxit or Adobe Reader. Hopefully, the sandbox has been hardened in abobe's reader such that another 0 day exploit doesn't come around for a long long time.

 

[mechBgon]

http://arstechnica.com/security/2012/11/zero-day-attack-reportedly-pierces-key-adobe-reader-defense/

Well you maybe better off with the Win8 reader than either Foxit or Adobe Reader. Hopefully, the sandbox has been hardened in abobe's reader such that another 0 day exploit doesn't come around for a long long time.

That was the first and only one (known) to breach Adobe's sandbox, so that's an exceptional track record, especially when compared to the FAIL streak that Reader 9 was on. Seemed like it was in the news every month or less.

In my preferred defense-in-depth scheme, the other supporting layers of defense around a PDF reader are:

1. Protect it with Microsoft EMET. Make your PDF reader a freak. Re-freak it at every boot-up.

2. Software Restriction Policy. Even a working exploit's not useful if its payload gets nuked arbitrarily when it tries to execute.

3. UAC at maximum, Standard User account. Limit the worst-case scenario.

4. For Adobe Reader X or XI, enable Protected View by default so files start off in a padded cell.


So far, the vanilla PDF reader in Win8 is getting the job done for me, although it's a little annoying that it can't work in windowed mode. There will inevitably be bugs discovered in it too, but the mitigations of an AppContainer sound pretty strong, and I think mitigation is the name of the game these days.

 

[TheRyuu]

So far, the vanilla PDF reader in Win8 is getting the job done for me, although it's a little annoying that it can't work in windowed mode. There will inevitably be bugs discovered in it too, but the mitigations of an AppContainer sound pretty strong, and I think mitigation is the name of the game these days.

I agree.

I have pdf.js installed in Firefox as well for convenience which should reduce the attack surface although I guess there's a bit of a tradeoff since I suppose you lose certain things compared to either the built in one (AppContainer) or Adobe Reader (sandbox/protected mode).

Chrome actually seems like more of a fit for pdf.js, if you think about it since chrome will run all javascript as unprivileged (I'm not 100% sure how Firefox handles it).

Also running EMET, all three system settings set to always on along with the various applications added. All you can really do is mitigate as best you can without getting in the way of convenience or driving yourself crazy.

 

[mechBgon]

http://arstechnica.com/security/2012/11/zero-day-attack-reportedly-pierces-key-adobe-reader-defense/

Well you maybe better off with the Win8 reader than either Foxit or Adobe Reader. Hopefully, the sandbox has been hardened in abobe's reader such that another 0 day exploit doesn't come around for a long long time.

I jinxed Adobe's track record, here's a new report via FireEye:

http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html

No word on whether the exploit can function in Reader's Protected View. But if it does what it says there (dropping malicious DLLs), then Software Restriction Policy would probably stop it, assuming it's been properly set up to watchdog all files including DLLs.

Another worthwhile tweak: enforce the DLL Search Order to prohibit using the "current working directory." For those so inclined,

1. scroll down to the Update Information page here, and get the update for your version of Windows: http://support.microsoft.com/kb/2264107

2. after installing the update, now run the Fix-It above the Update Information section.

3. after installing the update and then running the Fix-It, now barge into the Registry with regedit.exe and set CWDIllegalInDLLSearch to ffffffff (that's eight Fs). After saving that change, it'll show up as 0xffffffff, which is correct.

4. if you have software that freaks out at this enforcement, you can make exemptions. Under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, add a new key named for the offending executable file, then add a DWORD named CWDIllegalInDllSearch in that key and set the value to 0 for compete exemption, or 2 if it'll tolerate that. Myself, I have a couple older programs that'll lock up during launch if I don't make an exception for them.


Once in a while I read about malware that does abuse the DLL-search order, so if you have a case of securinoia, try this out