[furryincel]

Zerodium pays $1 million for Windows Zero Click RCE, but $80k for Adobe Reader RCE. I feel like in practice an Adobe Reader RCE would be almost as good as a Windows RCE. At the very least, it doesn't justify a 92% difference in price. Everyone checks emails and everyone feels safe with PDFs. The only thing would be perhaps not everyone uses Adobe Reader.

How hard do you think it would be to find an Adobe Reader RCE?

[Dread.Reaper]

Perhaps because Windows is an Operating system and Adobes only an application?
Interesting question... but I think it boils down to simple that Windows is an environment and all thats needed for the first example. Where you would have to have adobe installed for the second example.

[DramaKing]

Never heard of this Zerodium before, but how many people actually use Acrobat anymore. It's also pretty secure these days. Agree that a Windows exploit would be much more damaging.

[furryincel]

Never heard of this Zerodium before, but how many people actually use Acrobat anymore. It's also pretty secure these days. Agree that a Windows exploit would be much more damaging.

You think people in business don't use adobe reader? I would need some evidence one way or the other. Where do you think is the world's most common software used to view PDFs? Google Chrome?

[Dread.Reaper]

You think people in business don't use adobe reader? I would need some evidence one way or the other. Where do you think is the world's most common software used to view PDFs? Google Chrome?

Well sure, but all browsers support it now, Enterprise environments run an adobe management server that forces policies and a wide array of variables. Where, windows... well its just windows.

[resetti]

You think people in business don't use adobe reader? I would need some evidence one way or the other. Where do you think is the world's most common software used to view PDFs? Google Chrome?

yeah this is the thing, even if you find a 0day RCE in Reader, chances are 90% of victims you send it to (if you're being blackhat with it) wont use reader to open their PDFs, they'll use their default browser which would either be Edge, Chrome, Brave or Firefox

[Dread.Reaper]

yeah this is the thing, even if you find a 0day RCE in Reader, chances are 90% of victims you send it to (if you're being blackhat with it) wont use reader to open their PDFs, they'll use their default browser which would either be Edge, Chrome, Brave or Firefox

This happens frequently.
People ask a question and when given the answer argue the validity of it as though it changes the reality of the world they live in.

[resetti]

This happens frequently.
People ask a question and when given the answer argue the validity of it as though it changes the reality of the world they live in.

Yeah lol

Can't tell you how many times people have asked me for a "silent pdf exploit" and ive turned around and told them "they dont exist without a zero day in the reader application or default browser"

i should make a auto-respond bot for it at this point 🤣

[Dread.Reaper]

Yeah lol

Can't tell you how many times people have asked me for a "silent pdf exploit" and ive turned around and told them "they dont exist without a zero day in the reader application or default browser"

i should make a auto-respond bot for it at this point 🤣

Im sure its out there too, and some poor company who relies on Readers going to get nailed with it.
But, and hear me out with this one.
Technology changes. 😲(Gasp I know). I remember when Java Drive Bys and the such were great fun, but as time goes on so does technology.

Its truly is funny to see people clinging on to such archaic methods. When the true purpose of a Hacker is to find NEW ways of making technology do stuff its not suppose to. Not recycling the same Code cum over and over again.

[resetti]

Im sure its out there too, and some poor company who relies on Readers going to get nailed with it.
But, and hear me out with this one.
Technology changes. 😲(Gasp I know). I remember when Java Drive Bys and the such were great fun, but as time goes on so does technology.

Its truly is funny to see people clinging on to such archaic methods. When the true purpose of a Hacker is to find NEW ways of making technology do stuff its not suppose to. Not recycling the same Code cum over and over again.

Yeah thats obviously true, never know whats gonna come out the woodworks.

They will always cling onto it, because they don't know any better, plus they've probably see like 100 different fake videos showing some sort of "silent pdf exploit" so they believe its fully real

[Dread.Reaper]

Yeah thats obviously true, never know whats gonna come out the woodworks.

They will always cling onto it, because they don't know any better, plus they've probably see like 100 different fake videos showing some sort of "silent pdf exploit" so they believe its fully real

Haters will say its fake, but its 100% real, I mean its video proof!