Legacy Rich Media Security

Adobe Reader supports two type of “Rich Media” (video / animations). This article addresses the older, legacy type.

First let’s look at the main differences between the new “Rich Media Annotations” and the legacy “Movie Annotation” types:

Movie Annotations (Legacy) Rich Media Annotations (New)
Flash (SWF), Quicktime, Windows Media Player are all supported for playback. Note that iPOV’s standard is to publish to Flash SWF. Only Flash types are supported (SWF, FLV, H.264). Nearly any type of multimedia can be converted into one of the supported file formats.
Media opens in a separate window from Adobe Reader. Media is hosted either inline in the page or in a floating (non-native) control which is contrained to appear inside the Adobe Reader application window.
Supported from Acrobat Reader 6 on. Support introduced in Adobe Reader 9
Requires external player application to be installed; in the case of Flash the ActiveX control for Internet Explorer must be present on the user’s system Uses a version of the Flash Player that is built into Adobe Reader
Insecure. Launches external player outside of Reader sandbox. Several published security expliots are now know and Adobe has recommended that user’s turn off support for Legacy Media to protect themselves. Secure. Uses both the Flash player security as well as an extra layer of wrapper security built into Adobe Reader.

If documents all all hosted inside of a corporate intranet and form trusted sources then the security issues inherent in the Legacy multimedia may not be a huge concern and the advantage of opening in a window outside of the Adobe Reader window may be important to users – especially if the PDFs are hosted embedded into a Web page, and therefore with contained screen real estate.

Because Adobe now recommends that user’s disable support for legacy multimedia there may be a slight support issue when using Movie Annotations.  Legacy media can be disabled either by the end user via the “Edit” > “Preferences” > “Multimedia Trust (legacy)” or can be disabled by administrators setting Windows registry keys.  In cases where user’s have manually disabled Legacy media support they can be asked to re-enabled it; however if administrator’s have set a blanket policy of disabling legacy multimedia then IT may need to be asked to make changes.   Note that administrator’s can setup “whitelists” of trusted URLs to enable legacy media support only for documents within a companies firewall, which should alleviate much of the security concern.

A different source of support issues, common to both methods of embedding multimedia into PDFs is the small number of user’s who have choosen to install a third party PDF reader application.  Such applications are unlikely to support either format of multimedia when displaying a PDF, and further more unlike Adobe Reader may not even notify the user that a multimedia object is present.  Note that in corporate environments this is less of a concern.

User Experience

In the case that Legacy multimedia is enabled; when a user clicks on the “play” icon they will still get a warning dialog informing them that there is a risk and asking if they want to enable the playback.  Older releases of Adobe Reader use a popup dialog whereas newer releases use a “ribbon bar”.

Modern “ribbon bar” warning:

Older “popup” warning:

For users who have disabled legacy  multimedia support they will get a dialog informing them that their settings prevent them from playing multimedia:

References

Share