WinRT PDF exposes users to drive-by attacks. WinRT PDF, the default PDF reader for Windows 10, opens Edge users to a new series of attacks that are incredibly similar to how Flash, Java, and Acrobat exposed Web users for the past few years.
The Windows Runtime (WinRT) PDF Renderer library, or just WinRT PDF, is a powerful component built into recent Windows OS versions that allows developers to easily integrate a PDF viewing feature inside their apps.
The library is used for many apps distributed via the Windows Store, the default Reader App included in Windows 8 and 8.1, and even with Edge, Microsoft’s latest Web browser.
Hackers can abuse WinRT PDF for drive-by attacks
Mark Vincent Yason, security researcher with IBM’s X-Force Advanced Research team has discovered that WinRT PDF can be leveraged in drive-by attacks in the same way attackers used Flash or Java in the past.
Since WinRT PDF is Edge’s default PDF reader, any PDF file embedded inside a Web page will be opened within the library. A clever attacker can contain a WinRT PDF exploit within his PDF file, which could be secretly opened using an iframe positioned off screen with CSS.
The malicious code would execute, and exploit the WinRT PDF vulnerability in the same way exploit kits like Angler or Neutrino deliver Flash, Java, or Silverlight payloads.
All that an attacker needs to do is to find and create a database of WinRT vulnerabilities it could leverage to distribute his malware.
Hold your horses everyone!
“A major factor that will affect when and how often we see in-the-wild exploits for WinRT PDF vulnerabilities depends on how difficult it is to exploit them,” Mr. Yason explains.
He says that because Windows 10 implemented former EMET features such as ASLR protection and Control Flow Guard, “makes the development of exploits for WinRT PDF vulnerabilities time-consuming and therefore costly for an attacker.”
Mr. Yason will be presenting a more in-depth presentation of this attack scenario at this year’s RSA security conference in San Francisco.
Source:https://news.softpedia.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
