Highly sensitive Ferrari and McLaren information, from the World Motor Sports Council hearings into the espionage affair in July and September, has been leaked by the FIA by "a mistake".

The mistake that was made is extraordinarily brainless: the areas of the published documents that were blacked out in an attempt to censor parts of the papers, could easily be revealed by simply copying and pasting the text into a new document.

Such an error also happened in a much worrying and serious situation in 2005, when the Pentagon released a "censored" document about the infamous "Calipari case", an Italian secret service agent which was shot dead by an American soldier at a checkpoint in Baghdad, while on a hostage rescue mission (the hostage and the driver were both injured as well).

Interestingly, after a few days, Italian investigators on the case released an incomplete report on the incident which didn't include any information from the blackened parts of the Pentagon document, complaining that the Americans didn't want to disclose important pieces of information: quite amazingly, they didn't realize that the hidden text could be easily read.

In both cases, the authors of the PDF files didn't bother to encrypt the files in order to protect them from modification and copying, although this feature is available in every PDF-authoring programs since acrobat 3 come out in 2001, 6 years ago.

The observation that average users are unaware of the consequences of the simplest actions that they perform on a PC is saddening: these mistakes cannot be considered forgivable or inevitable anymore, especially in environments where sensitive information is produced and shared on a regular basis (industry, government, military, and so on).

To make and share a PDF with the whole world "seems" easy, but it turns out that even such a simple feat creates huge problems even in places where ICT security training should be a prerequisite.

Our job as security experts should be to explain to our customers that teaching the basics of personal computing and rising the security awareness of their users is not optional anymore. This is especially true with innocent-looking things like PDF files and the related software viewers (Acrobat above all), which were not designed with security in mind.

As already discussed in a previous article ( http://www.zone-h.org/content/view/14826/1/ ) PDF files can also be used as a sneaky vector for viral infections (PDF email attachments carrying viruses were first discovered in 2001) and for more elaborate, newer kind of attacks.

The latest security alert come in yesterday, when it was disclosed (but apparently not released in the form of a POC) that it is possible in Windows XP / 2003 to execute a malicious JavaScript from within Adobe Acrobat, by embedding it in a specially crafted PDF document.

This is bad, bad news. The US-CERT issued a report on sept. 24 that recommends to avoid opening unsolicited or untrusted PDF files, and to disable the displaying of PDF documents in the web browser.

I would also suggest to disable JavaScript execution (which doesn't require any user approval) in Adobe Acrobat - which can be a huge task to accomplish if an organization has more than a few clients installed.

So, not only end users don't have a clue about how to securely create and share PDF documents, but, once again, a mostly useless, rarely used feature which is enabled by default in an apparently innocent piece of ubiquitous software could become a security nightmare on a global scale.

Since it's just a matter of time before someone will make the nightmare become reality, we might rename it the Potential Disaster Format.

Comments Index (Total Messages: 0)

Post Reply
Name:	Guest
Title:
Comment:
Enter this security word

Powered by a Zone-H(ified) version of AkoComment 3.0!