WinRT PDF, the default PDF reader for Windows 10, leaves Edge users vulnerable to a new series of attacks that are incredibly similar to how Flash, Java, and Acrobat have exposed Web users in the past few years.
The Windows Runtime (WinRT) PDF Renderer library, or just WinRT PDF, is a powerful component built into recent Windows OS versions that allows developers to easily integrate a PDF viewing feature inside their apps.
The library is used for many apps distributed via the Windows Store, the default Reader App included in Windows 8 and 8.1, and even with Edge, Microsoft's latest Web browser.
Hackers can abuse WinRT PDF for drive-by attacks
Mark Vincent Yason, security researcher with IBM's X-Force Advanced Research team, has discovered that WinRT PDF can be leveraged in drive-by attacks in the same way attackers used Flash or Java in the past.
Since WinRT PDF is Edge's default PDF reader, any PDF file embedded inside a Web page will be opened within the library.
A clever attacker can contain a WinRT PDF exploit within their PDF file, which could be secretly opened using an iframe positioned off screen with CSS.
The malicious code would execute and exploit the WinRT PDF vulnerability in the same way exploit kits like Angler or Neutrino deliver Flash, Java, or Silverlight payloads.
All that an attacker needs to do is find and create a database of WinRT vulnerabilities it could leverage to distribute their malware via this new attack surface.
Hold your horses, everyone!
"A major factor that will affect when and how often we see in-the-wild exploits for WinRT PDF vulnerabilities depends on how difficult it is to exploit them," Mr. Yason explains.
He says that because Windows 10 implemented former EMET features such as ASLR protection and Control Flow Guard, this "makes the development of exploits for WinRT PDF vulnerabilities time-consuming and therefore costly for an attacker."
Mr. Yason will be come up with a more in-depth presentation of this attack surface at this year's RSA security conference in San Francisco.
The grey square represents a malicious PDF that could carry a WinRT PDF exploit
Source:
http://news.softpedia.com/news/wind...-exposes-edge-browser-to-hacking-501265.shtml
