If you're a criminal and you want to break into a network, a common attack method is to exploit a hole in software that exists on most computers, has its fair share of holes and is not automatically updated.
In 2002, that would have been Windows. Today, it is likely to be Adobe Reader or Flash Player, whose share of vulnerabilities and exploits are on the rise while Microsoft's is falling.
Nearly half of targeted attacks exploit holes in Acrobat Reader, which is used to read portable document format (PDF) files, according to security provider F-Secure. Meanwhile, the number of PDF files used in dangerous web 'drive-by' attacks jumped from 128 during the first three-and-a-half months of 2008 to more than 2,300 in the same period this year, the company said.
In addition, there are an increasing number of zero-day holes — vulnerabilities that are public before a patch is available. Like sitting ducks, users of affected software are left wide open to attack until a fix is available.
There have been zero-day exploits for the Flash Player plug-in, which is used for viewing rich media such as videos and interactive charts on websites. In one case this spring, a zero-day hole in Adobe Reader spurred security experts to recommend that users disable JavaScript.
Last week, a security researcher at Black Hat, who asked to remain anonymous, said: "As a result of the number of zero-day attacks on PDFs this year, large banks hate Adobe."
The scary statistics prompted Mikko Hypponen, chief research officer at F-Secure, to urge Adobe Reader users to switch to an alternative PDF reader at the RSA security conference in April.
Adobe "has a lot to learn from, of all places, Microsoft", Hypponen said at the time. At the Black Hat and Defcon security shows last week, others concurred.
"Adobe is the next Microsoft," said Roel Schouwenberg, a senior antivirus researcher at Kaspersky. "They are slowly realising that they have become a main vector of getting into a machine. We as an industry must push hard [to get Adobe to improve security]."
Read this
Photos: Inside the cage at F-Secure
At its Helsinki headquarters, Finnish antivirus company F-Secure opened the door to give a glimpse inside its mobile-malware testing cage
An Adobe manager said the problem stems from the fact that its software is so broadly used.
"It's only natural, given the fact that some of our products like Reader and Flash Player are some of the most widely distributed, that they would be targeted by attacks," Brad Arkin, director for product security and privacy at Adobe, said in an interview on Wednesday.
Microsoft has been in the same boat — and in many ways still is. The difference is in how the companies respond to the problem, according to experts.
Microsoft: Been there, done that
In January 2002, Bill Gates launched the Trustworthy Computing initiative and said security would be a top priority for the company. Microsoft had to do something to combat the negative press and public opinion over its strategy for countering the viruses and other security holes that plagued its software.
The company established a software development lifecycle program, designed to build security into the…
