hake Posted September 19, 2014 ID:880621 Share Posted September 19, 2014 I assume that MBAE free will not protect the standalone Adobe Reader but does it mitigate attacks on Adobe Reader in its the browser plugin incarnation? Link to post Share on other sites More sharing options...
Staff pbust Posted September 19, 2014 Staff ID:880794 Share Posted September 19, 2014 Yes that's 100% correct! Link to post Share on other sites More sharing options...
hake Posted September 20, 2014 Author ID:881105 Share Posted September 20, 2014 Thanks Pedro. Link to post Share on other sites More sharing options...
hake Posted September 27, 2014 Author ID:883744 Share Posted September 27, 2014 The proposition is that I am using MBAE Premium with the Adobe Reader shield DEACTIVATED and Adobe Reader XI is mitigated By EMET 4 (or later) with all mitigations (plus Deep Hooks, Banned Functions and Anti Detours) enabled. I open a PDF document in my web browser (say Opera 12.17 or Google Chrome) and Adobe Reader (in protected mode as I ALWAYS configure it) does not crash. Yet if I were to ACTIVATE the Adobe Reader shield in MBAE Premium then opening PDF documents in either a web browser (using Adobe Reader plugin) or using the Adobe Reader XI application would both crash Adobe Reader when it is running in protected mode. This suggests that a different protection is provided by MBAE when Adobe Reader shield is enabled in MBAE Premium compared to when it is not. I would have presented this follow-up question much earlier but it has taken some days for my feeble mind to compose it precisely and unambiguously. Link to post Share on other sites More sharing options...
Staff pbust Posted September 27, 2014 Staff ID:883863 Share Posted September 27, 2014 Yes that's correct. When a PDF is opened within a browser MBAE applies a different protection profile than if the PDF is opened by an instance of Acrobat Reader (acrord32.exe). Link to post Share on other sites More sharing options...
hake Posted September 28, 2014 Author ID:884065 Share Posted September 28, 2014 Thank you Pedro. I take it that the browser protection profile doesn't care if the plugin used to process the PDF is from Adobe Reader, Sumatra, Foxit or Google Chrome's PDF processor.. Link to post Share on other sites More sharing options...
hake Posted September 28, 2014 Author ID:884071 Share Posted September 28, 2014 I omitted to say that I infer from my observations with MBAE Premium that if the Adobe Reader shield is active then that shield takes precedence over the MBAE browser profile when the Adobe Reader plugin is in use. Link to post Share on other sites More sharing options...
Staff pbust Posted September 29, 2014 Staff ID:884368 Share Posted September 29, 2014 Yes you're right, if inside the browser then MBAE doesn't care if its Adobe, Foxit or anything else. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now