Set Adobe reader or any other PDF reader to open PDFs in the program and NOT in your browser. I honestly do not know whether the windows 8, Firefox and Chrome’s ( or Iphone/Android) inbuilt PDF viewers are vulnerable to these and other exploits, but I see no reason to suppose that they are fully immune. But as far as analysis so far can tell, the actual malware that gets downloaded or installed is windows specific. But be prepared for malware that will run on other Operating systems to get downloaded. The exploits in PDF readers do work in other operating systems apart from windows.
We also see numerous phishing attacks that pretend to be a PDF file but actually are an HTML webpage. This works because of the stupidity of Windows by default hiding known file extensions so you are easily mislead. If you set your PDF reader to, open in it’s own program and not inside the browser, you are better protected from this sort of very common attack also.
The settings vary for this vary according to your browser:
Step1. go to tools/manage addons
Step2. Select all addons in the drop down, look for Adobe PDF reader ( or any other PDF reader you have installed ) and then press the disable button.
That way any PDF you receive will only open in Adobe ( or other) reader itself and not in your browser, so cutting down the risk of any exploit infecting you or you being mislead by a fake file extension .
Step 1: Open Chrome and type “about:plugins” into the omnibox at the top.
Step 2: Scroll down and find Chrome PDF Viewer.
Step 3: Click the “Disable” link to prevent PDFs from loading within Chrome
Firefox see HERE and select use Adobe Reader ( default) or the alternative PDF reader you have installed.
Previewing PDFs in a browser is just too dangerous to take a risk with the current exploits and it is much safer to view them in the application itself which should be sand-boxed to prevent exploits slipping out.
Please read our How to protect yourselves page for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day. Be very careful when unzipping them and make sure you have “show known file extensions enabled“, And then look carefully at the unzipped file. If it says .EXE then it is a problem and should not be run or opened.