Invincea Protects By Virtualising PDF Reader Environment

Invincea is taking the idea of sandboxing, the fencing-in of downloaded files in a protected environment, one step further by moving all PDF files into a virtual appliance.

Invincea Document Protection runs as a virtual machine on the user’s desktop. Whenever a PDF file is opened, the Document Protection system takes control away from the installed PDF reader, such as Adobe Reader, and opens the file inside its virtual operating system. If the PDF has any malicious code, it affects the Invincea virtual system and not the user’s computer.

“You are going to get infected anyway, so why not just infect the virtual machine?” said Anup Ghosh, Invincea’s founder and chief scientist.

PDF Exploits Proliferating

Unlike many security products that open only “unknown” files in a sandbox environment, Document Protection treats every PDF file as a potential threat. With links and attachments coming from seemingly trusted sources, such as links to e-cards from friends and family, it is not easy to separate the threats from the good, said Ghosh.

People also tend to consider PDFs as safe and, while they may not click on an unknown executable file, have no qualms about opening a PDF file, he said. That is dangerous as PDF exploits continue to be on a “sharp incline”, Ghosh pointed out.

Even Adobe acknowledged the importance of sandboxing, as it introduced Protected Mode in its latest Adobe Reader X. Under Protected Mode, PDF processes such as PDF and image parsing, JavaScript execution, font rendering and 3D rendering happens in the sandbox, said Adobe.

According to Ghosh, however, Protect Mode will not prevent unauthorised read access to the file system or registry, restrict network access, or prevent reading or writing to the clip board, so some threats still remain.

Microsoft has also added sandboxing to Office, and Google implemented it into its Chrome browser.

“Nearly half of all security threats came from Adobe application exploits in 2010,” Ghosh said, referring to the number of zero-day exploits targeting Adobe Reader recently.

If the opened PDF file turns out to contain malware, whether as a suspicious script, a corrupt file, or a damaging program, it attempts to make the change to the virtual operating system. The change to the VM alerts the software, which then terminates the file, informs the user that a threat was found and deletes that instance of the virtual environment altogether.

Every time the user opens a PDF, a brand-new instance of the virtual machine is created to ensure the user always starts from a clean system.

The software also collects detailed security forensics data, such as the source of the file, the changes it made to the virtual system and what it tried to do online or on the network. The data can be used by IT managers or another security product to understand the threat.

The Invincea Document Protection is an optional extension to the company’s Invincea Browser Protection software. Under Browser Protection, the web browser runs in a virtual environment, allowing users to surf the web without any risk to their computers. Any downloaded malware makes changes to the virtual machine and, when the browser is closed, the virtual instance is deleted, removing any changes.

While a few years ago creating a virtual appliance on the desktop may have taxed the user’s hardware, modern hardware generally comes with sufficient memory and a fast enough processor to easily handle Invincea’s security appliance, Ghosh said.