Recommended Adobe Reader Security Settings

I highly recommend that anyone reading this that runs Adobe Reader on Windows (just about everyone running Windows) take the following steps to protect themselves from un-patched security vulnerabilities in the product. These are being actively exploited by malicious websites.

You can launch Reader through the Start menu in Windows XP by clicking on the All Programs link and selecting it in the menu. In Windows Vista and Windows 7, just press the Windows key (or click on the Windows logo in the bottom left corner of the screen) and type "Adobe Reader" and press return. Alternatively, you can just open any pdf document on your system, assuming of course that it's not from a questionable source.

Both of these settings are in the Preferences dialog box that's accessed by pressing CTRL-K while running Reader, or by selecting "Preferences" from the "Edit" menu.

1: Disable JavaScript

Note: If you open a document that has features that require JavaScript, I recommend that you only enable JavaScript while using the document. This of course assumes that you trust the source of the document.

To disable JavaScript in PDF documents, select the JavaScript entry from the list along the left side of the windows and un-check the first item. The dialog should look like the following when you're done:




2: Disable opening of non-PDF attachments

Click on the "Trust Manager" item in the categories list and un-check the first item:



There are many other things you can do to help secure your computer but I wanted to make sure that everyone I know at least took care of these. Adobe does not seem to be serious about security or keeping their products patched on a timely basis, so until we can stop using their products, we need to take matters into our own hands.

If you'd like to stop using Adobe Reader all together there are several free (and in some cases open-source) alternatives to Adobe Reader, just do a Google search for them.

I should mention that these suggestions come from Steve Gibson (GRC.com). I highly recommend his Security Now! podcast on the Twit network. You can get it on iTunes or from twit.tv/sn. If you have spare time, go back through his older shows.

Until next time.

Thomas Couey

CompTIA Security+ Certified Professional
CompTIA A+ Certified Service Technician