4

I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both recommendations are from 2010.

What more steps would you add to harden Acrobat/Acrobat Reader in 2021?

Improve this question
2
  • 2
    I'd run it in a VM.
    – user
    Apr 6, 2021 at 18:39
  • Do you actually need Acrobat Reader, or can you use some other PDF viewer? You'd probably be way safer with the latter, no matter how much hardening you do.
    – Joseph Sible-Reinstate Monica
    Apr 13, 2021 at 22:17

2 Answers 2

Reset to default
5
+25

Disabling JS is actually a very good idea. If you still want to add some extra protection I would recommend:

  • Set the security options to the highest level. Acrobat Reader implements a sandbox mode, which is called Protected mode and is usually enabled by default. You can also enhance it using the Protected View:

https://helpx.adobe.com/reader/11/using/protected-mode-windows.html

  • Use an up-to-date version of Acrobat Reader to avoid n-days and vulnerabilities which could undermine the security of the product
Improve this answer
2
  • 2
    Genuine question: Is being up-to-date relevant with 0-day vulnerabilities? I do, of course, agree that being up-to-date is crucial. I was just under the impression that 0-days refer to undiscovered vulnerabilities, that aren't patched.
    – user218666
    Apr 13, 2021 at 3:50
  • That is absolutely correct. It does make sense to speak about 1-days or n-days but not 0-days! Thanks for your correction!
    – borcho
    Apr 13, 2021 at 12:40
1

You can also enable "Sandbox Protections".

Go to Edit > Preferences > Security (Enhanced) > Sandbox protections.

"Protected View (PV)" is a highly secure, read-only mode for Windows that blocks most actions until the user decides whether or not to trust the document. It is similar to documents opened in Microsoft Office. Users get an option to simply chose if you trust the document or not.

You can configure the feature prior to deployment manually or via the Customisation Wizard. The basic setting is:

[HKEY_CURRENT_USER\Software\Adobe\(product name)\(version)\Privileged]
"bProtectedMode"=(0|1)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .