download issue 24 here - Help Net Security

Office applications (Adobe Reader, Microsoft Office, etc.) are being actively
targeted by malware authors. Malicious documents “in the wild” that try to infect
your machine by exploiting vulnerabilities in the office applications
abound. For more than a year now, PDF files targeting Adobe Reader have
been quite popular with malware authors.
I assume that you need to use vulnerable office
applications on your business computer,
and that applying patches to fix vulnerabilities
is not always possible, or that it requires leaving
your machines unprotected for a time. I
also assume that using alternative office applications
to change the attack surface is not
an option for your business.
The techniques featured here help to protect
you from malware that targets the general
Internet population. These techniques are not
appropriate to protect you from targeted attacks.
In a targeted attack, the malware author
has information about his target that allows
him to design his malware to operate in the
(restricted) environment of his target.
An example of malware used in a targeted attack
is a malicious PDF document designed to
steal confidential documents from a competitor.
I had one important criteria for selecting techniques
to feature in this article: use only free
software.
Least-privileged user account (LUA)
Almost all shellcode I see in malicious documents
(PDF, Word, Powerpoint, …) found “in
the wild” does the following:
1. Download a trojan from the Internet using
HTTP
2. Write the downloaded executable to
SYSTEM32
3. Execute the downloaded executable.
www.insecuremag.com 38