"Windows need to include a native PDF reader," said a security researcher - Microsoft are you listening?

Microsoft should add a basic PDF viewer to Windows to help protect users from the spike in attacks exploiting bugs in Adobe's Reader, "They don't even need to build it into operating system. They can make it an optional download like they did 'Save As PDF' add-in for Office." "Apple does this with its Preview […]

Microsoft should add a basic PDF viewer to Windows to help protect users from the spike in attacks exploiting bugs in Adobe's Reader, "They don't even need to build it into operating system. They can make it an optional download like they did 'Save As PDF' add-in for Office." "Apple does this with its Preview [application], and Microsoft should, too," said Sean Sullivan, of Finnish antivirus vendor F-Secure's North American operation. "I just want to view and read PDFs. I don't want to listen to them or watch them or launch executables from them or run JavaScript," Sullivan added, referring to several advanced features that Abobe's own PDF viewer, the for-free Reader, supports. Some of those features, including Reader's support of JavaScript and PDF specification's support for /Launch function, have been exploited by attackers in increasing numbers since 2008. According to tallies by antivirus vendor McAfee, PDF exploits were up more than eight times in 2009 compared to year before, a trend that has continued into 2010. And /Launch function, which allows PDF documents to run embedded executable files, is currently being exploited by attackers in a widespread malicious message campaign that tries to trick users into opening a rigged PDF. "Your customers are tired of exploits and complications that so many of today's PDF readers include," said Sullivan in a"Dear Microsoft" missive.

[Source]