Slashdot Mirror
Adobe Flash Zero-Day Attack Underway
Robellus writes "Security researchers have found evidence of a previously unknown Adobe Flash vulnerability being exploited in the wild. The zero-day flaw has been added to the Chinese version of the MPack exploit kit and there are signs that the exploits are being injected into third-party sites to redirect targets to malware-laden servers. From the article: 'Continued investigation reveals this issue is fairly widespread. Malicious code is being injected into other third-party domains (approximately 20,000 web pages) most likely through SQL-injection attacks. The code then redirects users to sites hosting malicious Flash files exploiting this issue.'"
And people wonder why I use noscript and flashblock. When untrusted adds in flash are being served on big "trusted" websites people are eventually going to get bit.
Situation Normal, All Flashed Up
This isn't the first or the last time Flash will have vulnerabilities discovered, and I understand this can happen with any software. It is just the frequency and consistency of these vulnerabilities that concerns me. When I install a binary blob from Adobe its always in the back of my mind that I could be opening up my system to attack.
A taste of what it could've been and what it might yet become?
_
\\/ are accustomed' - First Lensman
What kind of horrible, horrible update scheme will Adobe come up with to try to combat this?! The thoughts are too terrible to imagine...
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
It's Windows only because Microsoft wrote it to promote their Silverlight initiative. Siverlight doesn't work on Macs or Linux, so there's no point porting the exploit there.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Won't anyone here PLEASE think of the servers?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Silverlight does run on Mac OS X.
After all, it's my God-Given Right to name my son Robert'; DROP TABLE STUDENTS. I shouldn't be getting nasty phone calls from every school he's ever attended!
Request your free CD of my piano music.
In France, a popular IT proverb says "Adobe, c'est de la daube". True one more time today...
(won't translate; lost in translation).
-- Rastignac was here.
A Stack Canary is a value placed at the end of a function's stack frame. Just before function return, the canary's value is checked, and if it has changed, the user is notified.
So what you do is built a test version of Flash with canaries enabled in the compiler, then try feeding it all kinds of potentially buffer-overruning input.
To enable canaries:
- Visual Studio for Windows: Use the
/GS option
- GCC for Mac OS X: use -fstack-protector in your "Other C Flags" option in XCode
The Xcode-Users post I linked to says that stack canaries were discussed in session 109 at Apple's developer conference, in 2007 I think. You should be able to view it on the Apple Developer Connection website.I'll send you my bill in the mail.
Request your free CD of my piano music.
SQL injects aren't a MS specific problem, they are from poor programming and design. The same SQL injection attack could happen on any OS and DB
That is not the definition of zero day. If you are going to condemn people for using it incorrectly, at least use it correctly yourself. The 'zero day' status merely refers to how long the exploit has been known - the 'zeroth' day being the day it is publicly disclosed. This day is important due to the fact it is basically impossible for people to be patched against the vulnerability on this day. In other words, tomorrow this will no longer be a 'zero day exploit'. (no doubt it was disclosed several days ago and isn't a zero day exploit today either).
I.O.U One Sig.
Well it didn't take long for me to notice that my modem often showed activity even when I wasn't doing anything online. At the advice of a friend I bought the ZoneAlarm firewall.
It informed me that I was infected with the Welchia worm. What it does is apply security fixes to your Windows installation, and then it propagates itself on to other Windows hosts over the Internet!
This drove home to me the importance, when using Windows, of having a firewall that prevents connection coming from my own computer. ZoneAlarm does this.
Most firewalls just prevent attacks from outside. But if you're already infected, you want to know about network traffic originating from your own computer.
Request your free CD of my piano music.
> That's what temporary permissions are for.
Yes, I use them all the time, but what does that really mean? After I temporarily enable Flash/JS malware for a badly designed site which is just not viewable without them, I'm not going to get temporarily "pwned". It's already "game over".
Except for times like this, if the choice is enabling JS/Flash, or not getting information I was interested in, my thirst for information wins, all other things being equal (i.e., the URL looks like a legitimate one, etc.)
I never enable JS or Flash in order to see sites which I get to through advertisements, however.
Back in my day the only way to animate porn was flip the pages real fast. When technology does all the hard work for you, you lose any sense of personal accomplishment.
No, zero day exploit refers to the fact that the exploit is publicly disclosed (and in use) before there is a patch to fix it. So yes, tomorrow, this will STILL be a zero day exploit.
Modding Trolls +1 inciteful since 1999
SWF and other payload files cannot be uploaded and hosted on the compromised web server as easily as SQL-injecting a script fragment which downloads them from a 3rd party site in full control of the attacker. In this and all the recent mass-infection cases, the 3rd party hosts have been improbable domains Chinese domains likely registered ad hoc (such as wuqing17173.cn, woai117.cn or dota11.cn), and very unlikely to be in your NoScript whitelist, no matter how savage your browsing habits could be.
So in all "real world" scenarios seen so far, this one included, you are protected by NoScript in its default configuration, which blocks 3rd party embeddings even if you're visiting a trusted page.
Then if you want extra protection for the use cases you've listed (i.e. frequent usage of Flash-intensive community driven web sites), you can also configure NoScript to block ALL the embedded objects, with no regard for their origin: you will still be able to temporarily allow them selectively, by clicking on a visual placeholder.
There's a browser safer than Firefox, it is Firefox, with NoScript
If that's your definition, ('zero day' == ) then it still hasn't been used correctly, since the linked article is already a day old. ...
and
Given that the phrase 'zero day' is made of two single syllable words
OneSmartFellow isn't today.
Put identity in the browser.
ya, now you're just mumbling incoherent gibberish. So sad. Either accept that your perceived definition was wrong, or stop talking about how you don't like what it doesn't mean.
The phrase is not meaningless, there is no reason to stop using it.
Modding Trolls +1 inciteful since 1999
Just check NoScript Options|Plugins|Apply these restrictions to trusted sites too. In this configuration, NoScript effectively replaces FlashBlock, and it works on plugins different from Flash as well.
There's a browser safer than Firefox, it is Firefox, with NoScript
I'll just install the open source alternative to Flash on my Windows desktop...
Guess this is the moment for Gnash (http://www.gnu.org/software/gnash/) to shine!
Last Friday at work I was approached by a PM who was panicking: we lost the people who were working on Flash components for the corporate website. Someone was supposed to be flown from India to work on the component, but they couldn't make it for personal reasons. So the question was: can this be done in dynamic html? Well, of-course it can be done in dhtml, I said. It can look exactly like flash and do exactly what flash is doing. Some of the devs who were also working on Flash components, but who couldn't handle the Flash problem in this case, were insisting that it is in fact 'impossible' to do this, to make a dhtml component that would look and do exactly the same thing as Flash, and dhtml will not work in all browsers etc. 3 days later they were proven wrong.
In any case, my point is that Flash is an overkill for most GUIs on the web, it's good for video streaming, but even for that it is not absolutely necessary. However for whatever reason various dynamic functionality is often required by the business to be done within the browser. Something that cannot be done without some sort of scripting - sliding tabs, smooth transformations between images/text whatever. Such functionality is what browser side scripting is for. In order to be able to use this functionality at least javascript will have to be allowed. Whether anyone really wants to go to the website is a different question, but some websites provide useful functionality that is welcomed by the customers.
You can't handle the truth.
See also Symantec Threatcon here
So it looks as if you have the latest flash plugin (9.0.124) you may be ok.
Andy
Flash is an overkill for most GUIs on the web
.swf package can be done, even without a few hundred bucks worth of Adobe software, but it's more work than running "curl -o filename url" a few times. It's obfuscation, pure and simple.
Underline that, set it in boldface, carve it in granite, mod parent up, the works...
I really think the main reason people use flash is because it moderately increases the difficulty of reverse-engineering an interface. Chopping up a
Insists on having access to a Flash player, or it won't let me in.
"For 'Security' Reasons".
Now I have even more ammunition with which to criticize their "security". (this began when they recommended Internet Exploiter(tm)(r)(c) and the prevailing commercial "Operating System"s, and locked out me, with my Debian and IceWeasel: "IceWeasel? That's _not_ an approved browser!"
Hey, I know. I need a new bank. Does anybody know of one that's clueful enough to _not_ recommend IE?
Exceeding the recommended torque is not recommended.