RED ALERT: Turn OFF JavaScript In Adobe Reader!

Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324

This one is nasty!


the PDF document contains everything it needs to fully exploit the victim’s machine ā€“ it does not have to download anything off the net.

Boldfaced and red emphasis added by me.

And why you must turn off JavaScript:

Since this exploit has not been patched yet, I would like to urge you all to, at least, disable JavaScript in your Adobe Reader applications.

Here is how to do that.

Launch Adobe Reader.

Go to Edit->Preferences:

Click = big

UNCheck Enable Acrobat JavaScript:

Click = big

Click OK and then Exit Adobe Reader.

Don’t feel smug if you have a Macintosh or run Linux. Java is cross-platform. In addition, you could pass along an infected PDF without knowing it. Right now anyone can — only 6 out of 40 anti-virus programs found this exploit!

This is a new front in the malware wars. It will get ugly before it gets better.

And I want all of you who are thinking of snagging a pirated PDF off file-sharing services to consider this: All of them will likely be infected. I’ve seen it happen with other downloads — including audio and video files.

If they’ve cracked the PDF DRM, it’s highly likely they’ve gotten into the PDF itself and injected malware code.

Pay for your PDFs from reputable sources. “Free” will cost you in ways you can’t imagine.

Previously here:

Update Your Copy Of Adobe Reader Now!

4 Responses to RED ALERT: Turn OFF JavaScript In Adobe Reader!

  1. Patrick says:

    I have a Macintosh and I’ll feel smug if I darn well feel like it.

    • mikecane says:

      I know how it is. Used Macs until I waited too long to upgrade to System 7(!) for my LCIII. My downfall started then.

  2. bud says:

    The thing is, Mac users don’t use Adobe Reader. They can, but most do not because they are using the PDF creation and reading built into OS X almost of the time. Not that that does not have Adobe DNA, but it isn’t so easy to get under the hood when it it is so entrenched in the OS, perhaps in comparison to it being in a stand alone application like Adobe Reader.

    • mikecane says:

      Yes, but if you wind up with an infected PDF, you can pass it along without ever knowing it. The malware code remains in that PDF undetected until it hits the target OS: Windows. Not fun if it’s a business document you send to a customer who is paying your bills!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: