Adobe Reader Protect Mode

Back in July this year, Adobe announced the release of a new security framework which will add a greater level of security to their Reader application. Adobe Reader, which is widely known to be one of (if not the) largest threat vectors in terms of remote exploits, now employs a sandboxing technique to mitigate the attacker’s ability to run malicious code on the host. Adobe states that the new design has three major effects:

• All PDF processing such as PDF and image parsing, JavaScript execution, font rendering, and 3D rendering happens in the sandbox.
• Processes that need to perform some action outside the sandbox boundary must do so through a trusted proxy called a “broker process.”
• The sandbox creates a new distinction of two security principals: the user principal, which is the context in which the user’s logon session runs, and the PDF principal, which is the isolated process that parses and renders the PDF. This distinction is established by a trust boundary at the process level between the sandbox process and the rest of the user’s logon session and the operating system.

For more detailed information on this, Adobe has started a blog thread pertaining to this new approach, which can be found here.