A secure democratic Net is a fundamental right

If you neglect security and only think about functionality you will become malware with much functionality but with no security and you will lose all the trust that you have built your business on. Untill lately PDF was the main standard in business and government and everything would use PDF (from online forms to archiving to digital signing). It would all become PDF for Microsoft Haters. Everything except Microsoft and as Open Office is just struggling to become something that works good enough and is interoperable enough, PDF would become the leader of the 'everything but Microsoft' solutions.

In the beginning it was also normal to chose PDF because unlike Office Document you couldn't add scripts and instructions to those documents. It were just stupid documents that you used to print and that you were sure could be read by anyone everyhere.

But on the road to total stardom Adobe has forgotten that as you add functionality you should also heighten the security if you don't want to sink away in viruses, attacks and worms. Even better, most of the code became open source or public and so the malware coders (which are not always stupid but have sometimes very intelligent people working for or with them) had access to everything they need to know to make their own malware so difficult to find that there is no protection left.

First they have changed the insertion of their malware code from external javascript code that you could block to internal ADOBE PDF instructions that are hidden and that would be difficult to detect without too many false positives.

Now they have gone even a step further and they have encrypted that code so that even if it is detected if couldn't be analysed by an antivirus tool.

"Senior threat response engineer Vincent Cabuag adds that this relatively new encryption technique renders standard analysis tools useless in detecting the malicious script inside the .PDF file. The malicious script is obfuscated in a way that it requires the usage of certain APIs to be decrypted. Thus, it would require manual analysis to be able to emulate the embedded script."