4

I found this recommendation by the CISA to disable Javascript in Acrobat Reader. Also, this article recommends to disable Flash and Multimedia, and the opening of non-PDF attachments. Both recommendations are from 2010.

What more steps would you add to harden Acrobat/Acrobat Reader in 2021?

Improve this question
3
  • 2
    I'd run it in a VM.
    – user
    Apr 6, 2021 at 18:39
  • Do you actually need Acrobat Reader, or can you use some other PDF viewer? You'd probably be way safer with the latter, no matter how much hardening you do.
    – Joseph Sible-Reinstate Monica
    Apr 13, 2021 at 22:17
  • Unfortunately, this is asking for an open-ended list. As you can see from the answers, each one deals with different elements of a full list.
    – schroeder ♦
    Dec 20, 2023 at 8:18

3 Answers 3

Reset to default
5
+25

Disabling JS is actually a very good idea. If you still want to add some extra protection I would recommend:

  • Set the security options to the highest level. Acrobat Reader implements a sandbox mode, which is called Protected mode and is usually enabled by default. You can also enhance it using the Protected View:

https://helpx.adobe.com/reader/11/using/protected-mode-windows.html

  • Use an up-to-date version of Acrobat Reader to avoid n-days and vulnerabilities which could undermine the security of the product
Improve this answer
2
  • 2
    Genuine question: Is being up-to-date relevant with 0-day vulnerabilities? I do, of course, agree that being up-to-date is crucial. I was just under the impression that 0-days refer to undiscovered vulnerabilities, that aren't patched.
    – user218666
    Apr 13, 2021 at 3:50
  • That is absolutely correct. It does make sense to speak about 1-days or n-days but not 0-days! Thanks for your correction!
    – borcho
    Apr 13, 2021 at 12:40
1

You can also enable "Sandbox Protections".

Go to Edit > Preferences > Security (Enhanced) > Sandbox protections.

"Protected View (PV)" is a highly secure, read-only mode for Windows that blocks most actions until the user decides whether or not to trust the document. It is similar to documents opened in Microsoft Office. Users get an option to simply chose if you trust the document or not.

You can configure the feature prior to deployment manually or via the Customisation Wizard. The basic setting is:

[HKEY_CURRENT_USER\Software\Adobe\(product name)\(version)\Privileged]
"bProtectedMode"=(0|1)
Improve this answer
1
  • The answer before yours already listed Protected View.
    – schroeder ♦
    Dec 20, 2023 at 8:20
0

Recommendations for Configuring Adobe Acrobat Reader DC in a Windows Environment

PRESS RELEASE | Jan. 20, 2022

NSA Recommends Adobe Acrobat Reader Security Configurations FORT MEADE, Md. — The National Security Agency (NSA) released “Recommendations for Configuring Adobe® Acrobat® Reader® DC in a Windows® Environment” today. The technical report addresses the longstanding issue of cyber actors using malicious PDFs when targeting victim networks. Specifically, it details recommended Adobe Reader configuration settings for systems administrators to help minimize the risk of executable content and other malicious activity in a Windows environment.

https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2905591/nsa-recommends-adobe-acrobat-reader-security-configurations/

Improve this answer
1
  • This is just a link to an answer, not an answer itself.
    – schroeder ♦
    Dec 20, 2023 at 8:17

Not the answer you're looking for? Browse other questions tagged .