Warning: Adobe documents now spying on you!

[Colin Dunstan]

The newly released Adobe Acrobat Reader 7 allows authors of "tagged" PDF documents to select an arbitrary Web address which is then contacted whenever you open one of these documents. Through some small JavaScript code that is embedded in the document Adobe Reader is reporting back information including the fact that you've opened the document (which has a unique identifier), your IP address, and which viewer version has been used. The information is submitted over port 80 using HTTP, so it is unlikely that a home or office firewall would, in a normal configuration, block the activity, unless the firewall administrator is attempting to block Web browsing.

Keep your finger on the pulse. The company behind all this is Canada-based Remote Approach, who advertises their technology as a mechanism to supervise the usage of PDF documents: "We call it Document Distribution Management™. You can call it a way to measure and analyze your real audience and reach - including channels like email and peer to peer, not just people downloading from your web site. We offer a suite of tools and services to help you identify, manage and track your documents in real-time." The company claims this not to be spyware, since according to them the "software retrieves no information from the user's computer and leaves no software behind." Which is a bald-faced lie since they store and share your IP address.

Apparently the company is also working on a feature that would let a company block a document from being read if there's no Internet connection. Another feature in the works would allow tracking on a page-by-page basis.

Of course all of this happens "in the dark", without informing you and without your consent! I suggest you immediately change the settings of your Reader, and disable Javascript. Or even better, you can disable the spying feature by deleting all plugins or by renaming the plugin directory acroread7/Reader/intellinux/plug_ins. (remember to repeat this every time there is an update).

And don't you dare open pirated PDF e-books!

[first found at Linux Weekly News]

[cbarnett]

This is news! I might just go back to v6.... and hope many others register their negative opinion regarding this.

Craig.

[Jorgen]

Getting a firewall like Zonealarm would prevent any application from sending data out without your approval.

Jorgen

[Bob Russell]

That's an interesting idea, and it would be nice if it worked. But if I understand ZoneAlarm correctly, you either have to approve manually for each time it needs to communicate outside, or you have to allow it free communication. If there are legitimate needs for Acrobat Reader to communicate across the web (like for updates or for document content), then an average user would pretty much be forced to open it up altogether in ZoneAlarm to avoid a significant nuisance factor with repeated alerts.

Anyone else out there that can shed more light on whether this is a practical solution?

Originally Posted by Jorgen

Getting a firewall like Zonealarm would prevent any application from sending data out without your approval.

Jorgen

[Alexander Turcic]

Originally Posted by Jorgen

Getting a firewall like Zonealarm would prevent any application from sending data out without your approval.

Jorgen

Not necessarily, Jorgen. If your browser, e.g. Internet Explorer, is on your white-list, it is possible for applications to send data via your browser through a prepared URL (containing encoded data such as your IP). Not that I know this would be the case here.