92% of Windows PCs Vulnerable To Zero-Day Attacks On Flash

CWmike writes "More than 9 out of every 10 Windows users are vulnerable to the Flash zero-day vulnerability that Adobe won't patch until Thursday, Danish security company Secunia says. According to Secunia, 92% of the 900,000 users who have recently run the company's Personal Software Inspector (PSI) utility have Flash Player 10 on their PCs, while 31% have Flash Player 9. (The total exceeds 100% because some users have installed both.) The most-current versions of Flash Player — 9.0.159.0 and 10.0.22.87) — are vulnerable to hackers conducting drive-by attacks hosted on malicious and legitimate-but-compromised sites. Antivirus vendors have reported hundreds, in some cases thousands, of sites launching drive-bys against Flash."

Comments

Noscript

[fpophoto]

Browsing the web without a few browser mods is the only to surf these days anyway.

Re:Noscript

[ground.zero.612]

The noscript author is an assclown who silently enables ads (And disables noscript) for his own financial advantage.

Sounds like someone doesn't keep current on events, as this problem was worked on some months ago.

Re:Noscript

[causality]

Browsing the web without a few browser mods is the only to surf these days anyway.

Yeah. When I read this headline my first impression was "should I try to act surprised?"

This is just history repeating itself. Even if it required an NDA, if Adobe were smart they'd try to hire the OpenBSD folks to audit their code as they're obviously not capable of securing it themselves.

Re:Noscript

[causality]

The noscript author is an assclown who silently enables ads (And disables noscript) for his own financial advantage.

He admitted his error and has stopped doing this. See this link. The very first line? "I screwed up. Big time."

Any fool can make a mistake. It takes some guts to admit it, correct it, and try to move on especially in public like that. For that reason I do not count myself among the folks who still want to figuratively crucify him.

Re:Noscript

[hedwards]

Capable? I'm sure they could, I just get the distinct feeling that they don't feel like doing it. Which would be fairly typical, MS for instance likes to get angry when people mention the fact that they've been taking months to patch a serious vulnerability. Admittedly you don't want a patch to cause another vulnerability, but how long does it really take to get a proper fix?

Re:Noscript

[causality]

Capable? I'm sure they could, I just get the distinct feeling that they don't feel like doing it. Which would be fairly typical, MS for instance likes to get angry when people mention the fact that they've been taking months to patch a serious vulnerability. Admittedly you don't want a patch to cause another vulnerability, but how long does it really take to get a proper fix?

If the FOSS community is any indication, it takes anywhere from a few hours to a couple of days after the vulnerability is disclosed.

I am surprised how Microsoft often gets a pass on these issues, considering the vast resources at their command and the fact that Windows is a monoculture so their mistakes simultaneously affect millions of people. Most FOSS software is written by a "rag-tag band" by comparison, so why isn't Microsoft held to a higher standard of responsibility?

Re:Noscript

[MightyMartian]

Um, if your operating system is fucking brittle that a Flash update brings it down, then you've got really huge problems.

Re:Noscript

[Antidamage]

I for one am glad that Slashdot was on the scene and prepared to offer vital urban advice. In order to protect myself from this malware, I have closed all the curtains and moved my office to the back of the house. No fucking driveby is gonna get me, dawg.

Re:Noscript

[gmack]

People get pissed when Open Source patches break things too.

The difference is that in the Open Source world things tend to be more modular so making a change isn't as likely to cause unintended side affects.

Re:Noscript

[trifish]

as this problem was worked on some months ago.

It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

The character of the author of NoScript is that of the authors of

1) adware (redirecting to his ad-laden website with each meaningless update and preventing you from blocking these ads)

2) spyware/malware (changing configuration without the user's consent).

Re:Noscript

[trifish]

He admitted his error

You're kidding us right? Look up the definition of the word "error" and compare it with the definitions of the words "willful", "deliberate" and "intent".

Re:Noscript

[recoiledsnake]

Um, if your operating system is fucking brittle that a Flash update brings it down, then you've got really huge problems.

Huh. The post you're replying to is talking about Windows updates, not Flash, because the discussion got sidetracked at some point. I haven't heard of a Flash update bringing down Windows, except maybe if it messes with boot.ini or MBR or system files. I would imagine the same thing would happen in Linux or OS X.

Now if you're talking about Flash vulnerabilities in Windows, remember that OS X/Linux is similarly exploitable through Flash.

From http://www.theregister.co.uk/2009/07/22/adobe_flash_attacks_go_wild/

In an advisory that was updated after this article was published, Adobe says the "vulnerability exists in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat v9.x for Windows, Macintosh and UNIX operating systems."

The company expects to release an update fixing Flash in Windows, OS X and Unix on July 30 and fixing Acrobat and Reader on those same three platforms on July 31.

Re:Noscript

[PIBM]

I do not want to figuratively crucify him either.

The real thing would do just fine! ;)

Re:Noscript

[RedK]

Wait a minute, you mean errors can't be willful ? So if someone does something willfully, deliberately and with an intent, he can't later realise his mistake and make amends ? I think you need to review your position on this.

Re:Noscript

[The MAZZTer]

Latest version of NoScript still whitelists the authors own domains by default, and pops up his own domain on first run. I remove all his whitelists and just leave Google when I install it.

Re:Noscript

[bruckie]

It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

That's a pretty dismal view of human nature. I, on the other hand, believe people can change.

--Bruce

Re:Noscript

[node 3]

As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

If by "decent", you simply mean, "holds your archaic worldview", I suppose...

The notion that people's character is set in stone at birth is laughably absurd.

The character of the author of NoScript is that of the authors of

1) adware (redirecting to his ad-laden website with each meaningless update and preventing you from blocking these ads)

2) spyware/malware (changing configuration without the user's consent).

How about:

3) people who make mistakes.

The real "test of character" isn't whether he made a mistake, but what he does about it afterwards. So far, he seems to have responded appropriately, which shows good character, actually.

Re:Noscript

[oasisbob]

It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

No decent psychologist I know of would ascribe personality (of which character is a part of) to inborn traits, disregarding experience and environment. Character as an inborn trait is an asinine idea: neither the behaviorist nor the biopsychologist would take that statement seriously.

Re:Noscript

[Colonel Korn]

It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

That's quite the claim and quite maddeningly false.

Re:Noscript

[wastedlife]

Look through your adblock whitelist and remove or disable anything for that site. The whitelist was probably added in the earlier version and never removed.

Re:Noscript

[node 3]

He admitted his error

You're kidding us right? Look up the definition of the word "error" and compare it with the definitions of the words "willful", "deliberate" and "intent".

If you could be so kind as to do so yourself before asking others to, you could save us all a lot of trouble. *None* of those words are the antonym of error, nor do they exclude something from being an error.

You're confusing error with accidental or inadvertent. He didn't inadvertently start whitelisting ads, but it was an error for him to have done so, and he has since admitted his error.

For example, your post was deliberate, willful, and written with intent, but it's also erroneous.

Re:Noscript

[MMC Monster]

Which means that currently, a flash exploit could potentially alter, email, or delete any files in ~/.

Cold comfort, to say the least.

Re:Noscript

[recoiledsnake]

It's all about sandboxing. No user exploit can affect Unix system files unless running as root, which done on a per-program basis.

That's not sandboxing, that's privilege separation and has been implemented in Windows NT i think in the beginning of 90s and for consumer OSes like 2000/2K. I don't see why you point it out as if it was exclusive to UNIX and not present in Windows? We're not in MS-DOS/95/98 era anymore.

For Ubuntu, the October 2009 version will include Firefox sandboxing to reduce damage to user files in the case of an exploit.

It's not available yet, and it was implemented in Vista available since Jan 2007. I don't really see any point to your post except to inform that Ubuntu is late to the party. Also, a reference to what you say would be appreciated.

Re:Noscript

[causality]

Wait a minute, you mean errors can't be willful ? So if someone does something willfully, deliberately and with an intent, he can't later realise his mistake and make amends ? I think you need to review your position on this.

Indeed. I wonder how many people who are saying this would really want to be held to that standard. I know I wouldn't.

Compassion instead of condemnation is appropriate when you are dealing with someone who has changed their ways. If you must punish and condemn, save it for the unrepentant.

Re:Noscript

[Blue Stone]

>Look up the definition of the word "error" and compare it with the definitions of the words "willful", "deliberate" and "intent".

See: error of judgement.

Re:Noscript

[causality]

Because a "rag-tag band" doesn't have to QA their source change against an entire operating system? Remember how people tend to get pissed when MS releases patches that break functionality?

So if I understand you correctly, you are saying this is an unfair comparison, like comparing an apple and an orange.

I disagree because the concern you have raised applies to every general-purpose operating system on the planet. Certainly the software license (MS EULA or GPL) does not change this situation. If a bug is found in the Linux kernel or an important piece of userspace software, the people who patch it also have the same concerns about whether their fix is going to break anything else. So, I am satisfied that we are comparing an orange to an orange. We are still without a good explanation as to why the entity with superior resources and superior manpower is not doing the better job.

Re:Noscript

[AmiMoJo]

I wonder how true that really is.

Microsoft take so long to produce patches because they have to do a huge amount of testing. The figure they gave was something like 250 versions of Internet Explorer, when you take in to account every OS, every architecture, every language, every service pack level and so on that it runs on. I don't know if they test them all, but the implication was that extensive testing to avoid breaking the Elbonian language version running on Windows XP N SP2 took far longer than developing the patch itself.

Don't get me wrong, I'm not advocating delaying security patches to check for compatibility. It makes more sense to fix the vulnerability immediately and stop people getting infected, even if you break certain configurations in the short term. What I question is the proposition that OS software, perhaps by virtue of being more compartmentalised, is somehow less prone to this sort of thing, as opposed to simply doing the right thing even if it breaks stuff.

Re:Noscript

[Jurily]

It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

Bullshit, for several reasons:

1. The author might realize that was a stupid idea, if only from the flame he gets.
2. "Character" is not inborn, it's merely a set of displayed behavior. You act the same way around your mom you do with your boss or your spouse? Which one of those people is really you?
3. My all time favorite: the project might have a different author altogether. Read up on forking.

Re:Noscript

[VMSBIGOT]

When Microsoft released Service Pack 6 for WinNT 4.0 it broke Lotus Notes. They ended up re-releasing it as SP6a shortly thereafter. The problem was that people became gun-shy of installing either one of them on their systems. Now how many corporate systems were left unpatched due to that? When you have to worry about not only the 1,000's of software titles your own company releases but as well as about every major software title out there might be broken by a change/fix, it can take a while. How many people were wanting to storm the gates at MS over Notes being broken? How many people accused them of intentionally breaking Notes to help sales of Exchange? I know of a few titles that only run on NT4 and the readme's that went with them always said use SP5.

Re:Noscript

[Sir_Lewk]

Microsoft takes so long to produce patches because they figure if the general population doesn't know about it, then it can't be too pressing a problem and chose to ignore it until it is an issue. Then it takes them even longer because they supposedly do huge amounts of testing.

Re:Noscript

[toleraen]

Looks like I may have misunderstood what you meant by "FOSS". You were talking Adobe, someone brought up Microsoft. So I mistook your comments about FOSS developers to refer to smaller, non-Linux Kernel projects such as gnash, apache, firefox, etc compared to patching Windows. That's where I was going with my comparison.

I also think you might have things a bit off. Not sure if you follow the CVEs released against MS software, but typically shortly after they're released there's a security advisory with temporary mitigation steps released by Microsoft. Not always, but for most of the big hitters (>5.0 CVSS base score). You'll also recall that several years back MS would release patches much more frequently. They made the decision to release them once a month though to assist IT deployment. However if there's a big one they'll release out of cycle (see today's two out of band patches).

Do they fix everything? Nope, still have CVEs opened from way back. If you really want to hate on a big company with deep pockets not fixing their vulnerabilities, take a look at Apple's patch deployment schedule.

Re:Noscript

[ground.zero.612]

as this problem was worked on some months ago.

It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

The character of the author of NoScript is that of the authors of

1) adware (redirecting to his ad-laden website with each meaningless update and preventing you from blocking these ads)

2) spyware/malware (changing configuration without the user's consent).

trifish: I'm getting quick on the Citation Neededs. I know from firsthand experience that people can and do change. So please, please rattle off some quotations or links providing evidence to support your theory that people can't change their "character."

The MAZZTer: I would just like to inform you that there are are entries in the about:config menu that allow you to turn off the first run "pop-op." I'm not sure that your "NoScript whitelisting NoScript" is a legit complaint, as you are capable of removing that, and I see nothing unethical about a software provider whitelisting their own site in their own software.

Re:Noscript

[Spad]

The Adverts on the Noscript site are, frankly, ingenious and I hope nobody else starts deploying them in the same way that he has because they'd become almost impossible to block without some pretty complex document inspection; for example:

<style type="text/css">#vzt a {display: block; float: right; clear: left; width: 482px; height: 100px; background: transparent url("data:image/png;base64,[Base64 encoded PNG image data stripped for lameness filter]") no-repeat center;}</style>

<div> <div> <div id="vzt"> <div><span> </span><span> </span><span> </span><span> </span><span> </span><span> </span><a href="/t/vz/cotsohqbrnm76VUKNt"></a><span> </span><span> </span><span> </span><span> </span><span> </span><span> </span><span> </span><span></span><span> </span></div> </div> </div> </div> </div>

Re:Noscript

[recoiledsnake]

Microsoft takes so long to produce patches because they figure if the general population doesn't know about it, then it can't be too pressing a problem and chose to ignore it until it is an issue. Then it takes them even longer because they supposedly do huge amounts of testing.

Not just Microsoft, almost every company out there seems to be doing the same thing. Oracle, Apple, Adobe, all are famous for sitting on security holes for months if not years and seem to care only about exploits in the wild.

Re:Noscript

[Abalamahalamatandra]

That's not sandboxing, that's privilege separation and has been implemented in Windows NT i think in the beginning of 90s and for consumer OSes like 2000/2K. I don't see why you point it out as if it was exclusive to UNIX and not present in Windows? We're not in MS-DOS/95/98 era anymore.

Um, because it's practically unusable? Have you ever tried to configure unprivileged users on a Windows box and allow them to run ALL of the apps they need? Good luck with that.

Re:Noscript

[Chris Burke]

I think you need to look it up again and realize that "error" and "accident" aren't synonyms.

Or do you think it is impossible to do something intentionally that turns out to be a mistake?

Like being such a hard-head about this as an example?

Re:Noscript

[lostmongoose]

So far, he seems to have responded appropriately, which shows good character, actually.

*good* character would have been not doing it in the first place. he's only responding because he got caught, not because he feels he was wrong.

Re:Noscript

[Tikkun]

I, on the other hand, believe people can change.

[citation needed]

Re:Noscript

[causality]

Looks like I may have misunderstood what you meant by "FOSS". You were talking Adobe, someone brought up Microsoft. So I mistook your comments about FOSS developers to refer to smaller, non-Linux Kernel projects such as gnash, apache, firefox, etc compared to patching Windows. That's where I was going with my comparison.

I initially was talking about Adobe specifically and very generally also about the timeframes needed to patch new vulnerabilities. Microsoft was mentioned as well (by someone else to whom I replied) because they represent one way to handle the situation. I apologize if I dealt with this in an ambiguous way; I did not mean to confuse.

I also think you might have things a bit off. Not sure if you follow the CVEs released against MS software, but typically shortly after they're released there's a security advisory with temporary mitigation steps released by Microsoft. Not always, but for most of the big hitters (>5.0 CVSS base score).

I admit I don't stay up-to-date on Windows or Windows-related vulnerabilities though I have a good reason for it: I don't use that software. The principles though are easy enough to understand. The temporary mitigation steps you mentioned are a good thing, though I must tell you I greatly prefer the way FOSS projects generally handle things. Instead of mitigation steps (which are also often provided), I can usually download a new version or a source code patch almost immediately, and I am forced to regard that as superior. There is also usually a lot more I can do with a Linux system to limit privileges, sandbox, or isolate a running program from the rest of the system (particularly so for PaX, GrSecurity, a hardened toolchain, and maybe SELinux). Not to mention, there are often multiple projects that implement the same functionality and with no licensing restrictions, it is often a simple matter to replace a piece of software with a similar one.

My point is that if you add up the number of developers who have direct access to modify the Linux kernel and the core userspace software necessary to have a basic, working system, both the number of personnel and the financial resources available to them will be greatly dwarfed by what Microsoft commands. Microsoft is a giant in its industry any way you look at it. All things being equal, this would lead one to expect that Microsoft could do a better and more timely job of dealing with inevitable issues like software bugs. In my opinion, they do not.

You'll also recall that several years back MS would release patches much more frequently. They made the decision to release them once a month though to assist IT deployment. However if there's a big one they'll release out of cycle (see today's two out of band patches).

My hopefully-reasonable guess is that they are trying to balance business interests against the desire to fix problems ASAP. What you mention about IT deployment is a good basis for my guess. I think it best when users make their own decisions as to whether Microsoft is striking a balance that is favorable for them. For me, the need to avoid getting hit by a vulnerability and all of the implications that entails (botnets, etc.) is paramount, so their concern for the management of someone else's IT department is not suited to what I want.

Do they fix everything? Nope, still have CVEs opened from way back. If you really want to hate on a big company with deep pockets not fixing their vulnerabilities, take a look at Apple's patch deployment schedule.

I don't like Microsoft but I also don't hate them. Hating anyone would do nothing to them but would make me suffer and generally would reduce my quality of life. It would also cloud my ability to see a better way. So, if I did hate them I would see that as a personal weakness that it is my task to remedy. I would not just blindly embrace it.

I just

Re:Noscript

[node 3]

So far, he seems to have responded appropriately, which shows good character, actually.

*good* character would have been not doing it in the first place. he's only responding because he got caught, not because he feels he was wrong.

That's absurd. What he did is something that he can't possibly have thought would not be caught. He knew going into it he'd be caught. What he didn't realize is the backlash this would provoke.

He's admitted his mistake and corrected the problem. You don't have to forgive him, but this mythical notion of "character" being presented as some innate, unchangeable, inviolable attribute is silly.

By the way you're presenting "character", not a single person on the planet has "good character", rendering the term all but meaningless.

Re:Noscript

[Runaway1956]

People do change. I've witnessed several miserable old bastards change into dead bastards. Yes, people really can change for the better.

Re:Noscript

[BPPG]

--Bruce

There's your citation?

Re:Noscript

[diegorodriguezv]

Besides being unusable it is not there by default. When you install WinXP the installer only creates one account (with administrative privileges) and admin. password is blank.

Re:Noscript

[diegorodriguezv]

NoScript > Options > Plugins

Re:Noscript

[stewbacca]

As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".

Did I really just read this on slashdot, or did I get whisked away to some lunatic-fringe-Sarah-Palin fansite?

Re:Noscript

[ae1294]

WOW IS IT REALLY OVER NINE THOUSAND!?! (meme's are phun aren't they?)

Honestly the author of NoScript is just trying to figure out a way to make a few bucks since it's free software and all. What he did wasn't right but he could have done way way worse. Regardless if you use NoScript just be happy but know that there is some guy in a basement protecting you from the evil net monkey. If you don't use it then good for you as you trust in Adobe and Microsoft to protect you from the same evil monkey. Everyone really needs to stop bitching because it's not like he's Dr Evil or something and there are plenty worse / truely evil free stuff out there. Plus I don't recall NoScript being installed by default or anyone forcing you to use it.

I'd love to see one of these 'haters' make there own NoScript but that would require a few things they don't have...

Re:Noscript

[hairyfeet]

Uhhhhhh....dude? You're kinda confused there pal. The thing that got everybody's panties in a wad was NOT the Noscript guy whitelisting his own stuff, like you said that is to be expected.

Nope, what got everybody all kinds of pissed was that he was running a backdoor script that added a whitelist WITHOUT CONSENT to your Adblock Plus, which is most definitely NOT his software which means he didn't have the right to do that, plus pulling shit without the consent of the browser user is pretty douche-like behavior too. He asked the ABP guy for a free pass for his site, the ABP guy said he doesn't hand out free passes, so he did it by pulling some underhanded shit.

Sadly the guy can act like the biggest douche on the whole internets, because frankly we just ain't got nothing that is a drop in replacement for Noscript. You would think with all the "JavaScript malware o' the day" that browser would take a default deny approach and allow whitelisting, or at least give us the option buried in the guts somewhere, but right now Google and Mozilla are in a "my JavaScript is faster than yours" dick waving competition and can't be bothered. So like it or not, it is either use Noscript, let everything run, or turn everything off and break the Internets. I'll choose Noscript, even if the guy is kinda a dick.

Re:Noscript

[GPF(BSOD)]

No, you're on some lunatic-fringe-Barak-Obama fansite.

Re:Noscript

[Opportunist]

It was a non-issue.

Just as it was for MS until they were discovered by those that make money with malware. Sure, there was the odd exploit that some kid used to propagate some "look how cool I am" worm, but it was not really a biggie.

Then the influx of insanely powerful trojans came, then the bad press came, then MS reacted. Today, Windows can be considered a fairly ok secure system.

So the malware writers went on. Target of choice: Something that can be found on virtually every machine (akin to Windows). Obvious answer: Adobe PDF and Flash.

The market is a bit smaller than for Windows, of course, since you now need Flash as a vector and Windows as the target, and only the intersect between them is your possible target. That's the only reason why this wasn't used earlier, it was still quite possible to rely only on Windows. Now it's simply no longer a good attack vector.

Should Adobe finally get their act together (in about a year or two we'll see flash and pdf-plugins secured down so they don't offer a good vector anymore), the botnetters will move on. Maybe ICQ and other IM systems will be the next big thing. AGain, a smaller target group but still large enough. There are glaring security holes in most of them, the only reason why they're not used yet is simply that there are ways to infect larger amounts of machines with different means.

Re:Noscript

[ground.zero.612]

Uhhhhhh....dude? You're kinda confused there pal. The thing that got everybody's panties in a wad was NOT the Noscript guy whitelisting his own stuff, like you said that is to be expected.

Nope, what got everybody all kinds of pissed was that he was running a backdoor script that added a whitelist WITHOUT CONSENT to your Adblock Plus, which is most definitely NOT his software which means he didn't have the right to do that, plus pulling shit without the consent of the browser user is pretty douche-like behavior too. He asked the ABP guy for a free pass for his site, the ABP guy said he doesn't hand out free passes, so he did it by pulling some underhanded shit.

Sadly the guy can act like the biggest douche on the whole internets, because frankly we just ain't got nothing that is a drop in replacement for Noscript. You would think with all the "JavaScript malware o' the day" that browser would take a default deny approach and allow whitelisting, or at least give us the option buried in the guts somewhere, but right now Google and Mozilla are in a "my JavaScript is faster than yours" dick waving competition and can't be bothered. So like it or not, it is either use Noscript, let everything run, or turn everything off and break the Internets. I'll choose Noscript, even if the guy is kinda a dick.

I've never claimed that what the NoScript and AdBlock Plus guys did was anything less than shady and unscrupulous. I'm simply stating: "People have changed, people will change, and when it is for good reason, all humans benefit."

Re:Noscript

[hairyfeet]

Uhhhh.....maybe I'm confused here, but WTF did the ABP guy do that was in any way shady?

He designs a plugin that blocks ads. People use it and are happy. Noscript guy asks ABP guy to give his site a walk. ABP guy says that is up to the users, that he just don't go around handing out free passes, which of course is what he is SUPPOSED to do, as it would be kinda pointless to have an ad blocker that didn't work on any site that asked the creator nicely or maybe slipped him a little cash. Noscript guy gets pissy and then writes a nasty into his program that goes behind the users back and rewrites the whitelist in ABP to give HIS site a free pass. When users find out they rightly call him a douche and let the hatred fly, which gets the Noscript guy to back off.

I'm sorry, but I don't exactly see where there is anything shady by the ABP guy. All the Noscript guy would have had to do is have a little banner and button and said "I'm kinda broke, so if you like Noscript would you please click this button so my ads won't be blocked by ABP and I can keep working on Noscript? Thanks." and most would have clicked it and that would be the end of that. But by acting like a douche I'm sure quite a few did just as I did and used "About:config" to make sure his site never darkens my internets again. Sadly I can't just toss his warez in the trash, because Mozilla and Google are in a "my JavaScript epeen is bigger than yours" mode and nobody has whitelisting in their browsers for JavaScript.

Mark my words, 5 years from now we WILL look upon JavaScript like we do ActiveX today. We will either come up with a new web scripting language built from the ground up to be secure, or JavaScript will be ripped apart and rebuilt for security. All the crap like sandboxing now is just putting bandaids on bullet wounds because JavaScript simply isn't designed with security in mind. And with the "JavaScript malware o' the day" you would be nuts to have default allow for it or Flash. So the guy can be as big a douche as he wants, like it or not we need Noscript.

Re:Noscript

[ground.zero.612]

Uhhhh.....maybe I'm confused here, but WTF did the ABP guy do that was in any way shady?

He designs a plugin that blocks ads. People use it and are happy. Noscript guy asks ABP guy to give his site a walk. ABP guy says that is up to the users, that he just don't go around handing out free passes, which of course is what he is SUPPOSED to do, as it would be kinda pointless to have an ad blocker that didn't work on any site that asked the creator nicely or maybe slipped him a little cash. Noscript guy gets pissy and then writes a nasty into his program that goes behind the users back and rewrites the whitelist in ABP to give HIS site a free pass. When users find out they rightly call him a douche and let the hatred fly, which gets the Noscript guy to back off.

I'm sorry, but I don't exactly see where there is anything shady by the ABP guy. All the Noscript guy would have had to do is have a little banner and button and said "I'm kinda broke, so if you like Noscript would you please click this button so my ads won't be blocked by ABP and I can keep working on Noscript? Thanks." and most would have clicked it and that would be the end of that. But by acting like a douche I'm sure quite a few did just as I did and used "About:config" to make sure his site never darkens my internets again. Sadly I can't just toss his warez in the trash, because Mozilla and Google are in a "my JavaScript epeen is bigger than yours" mode and nobody has whitelisting in their browsers for JavaScript.

Mark my words, 5 years from now we WILL look upon JavaScript like we do ActiveX today. We will either come up with a new web scripting language built from the ground up to be secure, or JavaScript will be ripped apart and rebuilt for security. All the crap like sandboxing now is just putting bandaids on bullet wounds because JavaScript simply isn't designed with security in mind. And with the "JavaScript malware o' the day" you would be nuts to have default allow for it or Flash. So the guy can be as big a douche as he wants, like it or not we need Noscript.

I don't need the commentary or the summary in your words as I followed the issue until it was, you know, resolved.

Flash can DIAFF (flash fire)

[hattig]

Well at least the iPhone is safe...

Will Flash just die already! We have the video tag, IE users can suck it up as well. FlashBlock for Firefox, but what to use for Chrome?

Re:Flash can DIAFF (flash fire)

[ByOhTek]

People wonder why I don't install flash, all web sites have a perfectly usable non-flash variant of the site, and get extremely PISSED OFF when an enterprise software manufacturer requires the use of flash for important parts of their site.

Re:Flash can DIAFF (flash fire)

[Frosty Piss]

Will Flash just die already!

There's always Silverlight... No, really!

Re:Flash can DIAFF (flash fire)

[tunapez]

all web sites have a perfectly usable non-flash variant of the site

I've found a more than a few that did not have Non-flash alternatives, sadly it's becoming less rare. Maybe w/ the proliferation of pages designed for mobile device displays we can see smaller pages w/ less bells & whistles loading all the time.

Anyone find a good aggregate of functional mobile web pages? I've found the basics, would like to try more of these at home.
Goog
Msn/Live/Bing/...
yahoo

Re:Flash can DIAFF (flash fire)

[tunapez]

What did YOU do to my post? Or maybe I forgot to add h t t p : / / and /. fixed it for me.
should have been:
http://google.com/m
http://m.bing.com/
http://m.yahoo.com/

Re:Flash can DIAFF (flash fire)

[Kalriath]

That's the biggest load of bullshit in a while.

You talk about Silverlight being worse than Flash because it uses ActiveX -- hey guess what... SO DOES FLASH!

ActiveX is not a platform, it's a specifically formatted way of producing a Dynamic Link Library that the browser can load it as a COM object (usually in the browser's context - so the users). It by definition cannot have security vulnerabilities - the host can, and the plugin can, but "ActiveX" can't.

Re:Flash can DIAFF (flash fire)

[ByOhTek]

typoe 'not all' instead of 'all'

Re:Flash can DIAFF (flash fire)

[ByOhTek]

typoe 'unfortunately not all' instead of 'all'

This is why...

[Darkness404]

This is the reason why we either need diversity in software or OSS. Flash is installed on practically ever computer, and for good reason, many sites require Flash. However relying on a single software and single software versions is a bad idea, even more so when it is closed-source.

Re:This is why...

[hedwards]

It's not stupid, that's been pretty solid for sometime. Ever wonder why so few crackers target anything other than Windows? The smaller the segment of the market a bit of software takes up the smaller the reward for breaking it.

Benefits to monoculture? You mean the benefits to MS and Apple for not really having to properly compete with platforms that Adobe doesn't support? Or the benefit of being largely left to the mercy of a company whose software regularly crashes, freezes and randomly covers parts of the screen?

I'm sorry, I'm just not seeing any particular benefit to allowing a monoculture to develop. Sure you don't need millions of implementations, but it's kind of hard to justify trusting one company when they seem to care so little about the trouble they cause.

Re:This is why...

[causality]

annoying but then what...the advantage of a near monoculture in comupters outweight greatly this annoyance.

The answer to that is to have independent implementations of widely-supported open standards. Then you get the benefits that you cite, with the one exception that the maintainers of each implementation would need to issue their own patches. I believe this would be outweighed by the fact that it's unlikely for each independent implementation to have the exact same flaw. The result would be a superior experience for users while maintaining similar capabilities across different systems.

Re:This is why...

[AmiMoJo]

Flash is installed on practically ever computer, and for good reason, many adverts require Flash.

There, fixed that for ya.

Re:This is why...

[Pentium100]

However, they are the same. The biggest difference in car controls that I have seen is automatic transmission vs manual. Everything else is the same, you can just get in the car and drive it.

Now compare KDE, Gnome, (whatever other GUI for Linux), Windows, MacOS. You can't just sit at the computer and start using it, you need to find how to use that GUI first (or if you want to compare command lines, compare Linux and DOS).

It would be nice if Linux had the same GUI as Windows (I don't care who made it, just that it looks almost the same).

Re:This is why...

[initdeep]

can you drive a car if all of these other controls are not in the same place?

yes you can.

as long as the major necessary parts (the steering wheel, pedals, etc) all work in basically the same way and are located in basically the same place, the rest are items that are nice to have, but not necessary for operation.

it's kind of like why almost all email programs have a "send" button and a "to" field, and almost all browsers have an address bar and forward/back buttons.

the basics don't differ from one to the next much because the basics make the program usable by more people.

Re:This is why...

[Pentium100]

You turn on the headlights before starting to drive (at least in my country headlights must be on always, even in sunlight when you can't see if they are on). If it takes you a bit of time to find the "headlights" symbol on a button/lever well, it's a minor inconvenience. You adjust mirrors only sometimes.

Radio is not important.

However, you can usually sit in a car and drive it with only a short time needed to find all the important controls.
Now imagine a car that's controlled by joystick. Or a car where all pedals are in different positions. Or a car, modified for the disabled, that has buttons on the steering wheel instead of pedals. You wouldn't be able to just sit in the car and drive it.

The same with programs. If I need to press Ctrl+B to make the selected text bold on one program and click a button on the toolbar in another (example from the top of my head) I may have trouble using one of the programs after I have used the other one for some time.

Hmmmm.....!

[Monkeedude1212]

Everybody, Roll back to Flash player 5 for a little bit. And then have that warm gooey feeling of when you first tried animating with it... Now change your pants.

FlashBlock

[asdf7890]

This makes FlashBlock all the more useful. No flash that I don't explicitly enable ever runs in my browser, which should stop these drive-by attacks in their tracks (unless they somehow infect flash objects I would normally allow, instead of injecting a new "hidden" object into the hacked sites).

Re:FlashBlock

[recoiledsnake]

Wrong . http://lists.openwall.net/full-disclosure/2008/07/25/15

Re:FlashBlock

[Anonymous Coward]

Glad that I use IE and Vista!

This flash vulnerability cannot be used to install malwares because of the Vista/IE protected mode (sandboxing) which prevents such flaws in IE or its plugins from being exploited to write data on the hard drive.

For IE8 users running XP, you can prevent flash player from executing automatically when you surf on unknown sites:
no need for third party plugin, just go to tools, manage addons, double click on flash, and click on remove from all site. Then each time a site wants to use flash, a yellow bar will be shown so that you can decide to authorize flash on this particular site.

Fix to all Flash problems

[jo42]

The fix to all Flash problems lies here on Adobe's own web site: How to uninstall the Adobe Flash Player plug-in and ActiveX control.

Re:Fix to all Flash problems

[Anonymous Coward]

Get rid of Acrobat reader while you're at it: http://kb2.adobe.com/cps/326/326641.html

Squid + Dansguardian can filter it out

[blhack]

If you're not using this, or something like it, then your Admin isn't doing their job.

It looks like none of the users are getting flash until thursday. Sorry guys, no pandora for you. (also looks like I won't be getting a cake on sysadmin day).

Re:Squid + Dansguardian can filter it out

[Sir_Lewk]

If you're not using this, or something like it, then your Admin isn't doing their job.

Or you're not on a corporate network at the time and thus most likely don't have an Admin besides that little pamphlet that came in the linksys router box ;)

Re:Squid + Dansguardian can filter it out

[jesser]

You can't really filter out Flash unless you also filter out zips, javascript, and data: URIs. You're breaking Pandora without actually protecting your users from being exploited through Flash player.

Adobe

[sys.stdout.write]

is like RealNetworks was years ago.

The only difference is that when Real started raping people's computers it was replaced.

I've Always Said...

[Anonymous Coward]

I've always said(for years) that Flash would be the killer infection vector and that its cross platform ubiquity would be the Achilles heel for Linux and Mac.

This is but a taste of things to come. Flash is an abomination. It has too much power with too little end user control over that power. Combined with its insanely large install base and you have disaster waiting to happen.

I'm not sorry for being right all the time. So suck it!

Re:I've Always Said...

[recoiledsnake]

What about all the people(a ton of people on this website who always get modded up) who always said that the Unix security model and OS X is the way to go?

Re:I've Always Said...

[ukyoCE]

You heard it here first, Anonymous Cowardon is right.

I use Flashblock in every browser that has Flash installed, but I've still seen Flash crashing my browser anyway, and I suspect some exploits will work despite Flashblock as well.

Re:I've Always Said...

[ukyoCE]

AFAIK a flash exploit would still be running as your user and be very limited in what it can do.

To gain root access to your system it would have to piggyback on an independent root escalation exploit, or perhaps keylog the user escalating to root priviledges, if the OS allows user-level evesdropping on escalation dialogues.

So yes, the Unix security model is still a big improvement.

I believe Vista is trying to follow the same conventions, it's just having a difficult time doing so while trying to remain remotely backwards-compatible with the many apps coded for prior Windows versions that expect to be able to do anything to the system.

Re:I've Always Said...

[Kalriath]

Difficult time doing so? It's the same model! Let me rephrase your post slightly:

AFAIK a flash exploit would still be running as your user and be very limited in what it can do.

To gain root access to your system it would have to piggyback on an independent root escalation exploit, or perhaps keylog the user escalating to root priviledges, if the OS allows user-level evesdropping on escalation dialogues.

So yes, the Vista security model is still a big improvement.

I believe OS X is trying to follow the same conventions, it's just having a difficult time doing so while trying to remain remotely backwards-compatible with the many apps coded for prior Mac OS versions that expect to be able to do anything to the system.

(I realise the following points: Mac OS X actually does a fairly decent job of it, and Mac OS doesn't even pretend to be backwards compatible with any apps coded for prior versions)

The way Vista's UAC works, is to actually create the UAC dialog on "the secure desktop" - basically it's the same context as the logon screen. At this point, only keyloggers installed as drivers would be able to intercept anything entered. And installing a driver requires administrative intervention. Unfortunately, this is where Windows' weak point comes in: the user. If the user clicks "Continue" (I don't know where "Cancel or Allow" comes from, the options are "Continue or Cancel") then there's not much the OS can or should do, eh?

It's the same for OS X, I believe. Not sure though if the escalation dialog is actually some sort of magic secure window.

Zero-Day attack

[smittyoneeach]

Zero-Day attack
The coder: whack
One means to stop
The furbrained attack
Burma Shave

FlashBlock may not be fast enough

[Animats]

FlashBlock stops Flash from running after a second or two. Some of the remote code still runs. This may be enough time for an attack to get through.

Re:FlashBlock may not be fast enough

[asdf7890]

FlashBlock stops Flash from running after a second or two. Some of the remote code still runs. This may be enough time for an attack to get through.

I was under the impression that it replaced the flash objects in the page's DOM before Firefox gets chance to call the plugin. I'll have to see if I can't verify that...

Re:FlashBlock may not be fast enough

[fpophoto]

Do you have a link for that? The info I've read suggests otherwise. AFAIK, Flashbock blocks Flash completely before the page even loads, although this suggests a bypass is very easy.

Re:FlashBlock may not be fast enough

[thePowerOfGrayskull]

the exploit demo they link to does not work in 3.5, so it seems the bypass gap was closed...

Re:FlashBlock may not be fast enough

[MillionthMonkey]

Flashblock e.g. could be making some of the same API calls that Flash does on startup and can screw it up in many ways e.g. by not returning from some function or by setting some goofy variable. You don't know the extent of the initialization. I personally love Flashblock... the web was starting to get really annoying.

Re:FlashBlock may not be fast enough

[Adm.Wiggin]

I'm on 3.0.11 and it didn't even work...

Re:FlashBlock may not be fast enough

[Adm.Wiggin]

I've seen the video I'm headed for frequently flash on the screen before Flashblock takes it out (Gentoo Linux here).

Millions of complacent idiots devastated

[David Gerard]

A computer worm that spreads through Flash and PDFs on PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.

Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying "COME AND GET IT."

Millions of smug Mac users and the four hundred smug Linux users pointed and laughed, having long given up trying to convince their Windows-using friends to see sense. "There's a reason the Unix system on Mac OS X is called Darwin," said appallingly smug Mac user Arty Phagge.

"It can't be stupid if everyone else runs it," said Windows user Joe Beleaguered, who had lost all his email, business files, MP3s and porn again. "Macs cost more than Windows PCs."

"Yes," said Phagge. "Yes, they do."

Ubuntu Linux developer Hiram Nerdboy frantically tried to get our attention about something or other, but we can't say we care.

Re:Millions of complacent idiots devastated

[LordLimecat]

So does vista, chief.

Re:Millions of complacent idiots devastated

[cbiltcliffe]

The vulnerability exists, yes. But I can pretty much guarantee that any payload is only going to target Windows systems.

Sure, they'll be able to get "deltree c:\WINDOWS" or steal_all_your_passwords.exe onto your Linux box, but it will bork when it tries to run.

Re:Millions of complacent idiots devastated

[Eunuchswear]

Unix users have privelege separation.

which protects the uninteresting, easy to reinstall OS and apps, and leaves your important data swinging naked in the wind.

Unless you run your browser in a jail, of course.

Re:Millions of complacent idiots devastated

[0x537461746943]

Unfortunately you don't need root privileges to get to private user data and launch trojans. My user data is the most important to me.

Re:Millions of complacent idiots devastated

[Viol8]

I have these things called "backups". You might want to try them sometime.

Re:Millions of complacent idiots devastated

[Viol8]

Err , actually so long as you keep backups of your private data a trojan coming along and screwing it up is a minor annoyance. Finding your computer OS has an infection and won't run properly or even boot is a lot more of a PITA when you have to spend half a day reinstalling it and all the apps and setting everything up the way you want.

Re:Millions of complacent idiots devastated

[recoiledsnake]

WRONG on many levels. If you're not running as admin, only your user files will get affected in all the current OSes including XP. But IE8 on Windows 7/Vista does sandboxing and hence is more secure than Firefox on Ubuntu out of the box. Don't believe me? Read is straight from the horse's mouth. http://blogs.zdnet.com/security/?p=2941

Why Safari? Why didnâ(TM)t you go after IE or Safari?

Itâ(TM)s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs donâ(TM)t do. Hacking into Macs is so much easier. You donâ(TM)t have to jump through hoops and deal with all the anti-exploit mitigations youâ(TM)d find in Windows.

Itâ(TM)s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesnâ(TM)t have anti-exploit stuff built into it.

[ SEE: 10 questions for MacBook hacker Dino Dai Zovi ]

With my Safari exploit, I put the code into a process and I know exactly where itâ(TM)s going to be. Thereâ(TM)s no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I donâ(TM)t know where it is. Even if I get to the code, itâ(TM)s not executable. Those are two hurdles that Macs donâ(TM)t have.

Itâ(TM)s clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But thatâ(TM)s only half the equation. The other half is exploiting it. Thereâ(TM)s almost no hurdle to jump through on Mac OS X.

Re:Millions of complacent idiots devastated

[unifyingtheory]

I see blatant plagiarism gets you a +5 funny on /. these days.

Re:Millions of complacent idiots devastated

[Eunuchswear]

Ok, if you're worried about easily detectable changes.

What if the malware makes hard to detect changes, or, even worse, no changes at all and just copies your nice data to some naughty person?

Re:Millions of complacent idiots devastated

[cbiltcliffe]

Well, not a whole lot, on a poorly set up system.

But there is the fact that a single user cannot bork a system for other users. That certainly counts for something.

And the simple fact of marketshare means that Linux will not be targetted in this way for the forseeable future.

And as to deleting data, I haven't run across malware for years that does this. Usually it tries to embed itself into the system somewhere, and steal information. The "deltree C:\WINDOWS" comment was to simplify the payload for explanation.
But an embedded info-stealing payload would be difficult to write for Linux, because there are so many variations. It would essentially have to be downloaded as source and compiled on the system. But if /home and /tmp are mounted noexec, then it makes it difficult for the malware to then run. The user can't put it anywhere else, and it can't execute to run from those locations.
It could be called directly by the shell, but again, there are several different shells for Linux, with no guarantee of any given one being installed on a system.

Possible? Certainly. But much less likely, for a number of reasons.

Re:Millions of complacent idiots devastated

[thisnamestoolong]

It's not plagiarism if you cite your sources dude

Re:Millions of complacent idiots devastated

[Jah-Wren Ryel]

Don't believe me? Read is straight from the horse's mouth

Wish I could, but it appears to be highly trademarked.

Re:Millions of complacent idiots devastated

[Colonel Korn]

A computer worm that spreads through Flash and PDFs on PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.

1) This vulnerability exists on OSX, Windows, and Linux.

2) The annual pwn2own competition, among others, shows that Linux and Windows are similarly secure and OSX is much less secure. OSX goes down first every year, while Windows and Linux both last until later days of the competition when more direct access to the systems is granted to the contestants.

A Windows machine is more likely to be compromised, but that's because of market share. "Insecure by design" implies that you're talking about the security of the OS against someone who wants to compromise it. It's proven every year that only OSX lags in this area, and it lags quite badly (this year's winner rated the difficulty of compromising Vista and Linux as a 9-10, and the difficulty of breaking into OSX as a 3, IIRC).

3) Goto 1)

Re:Millions of complacent idiots devastated

[EvilBudMan]

In all seriousness, couldn't this happen with any OS as JAVA is cross platform. And,....we'll for Windows users just leave that stuff disabled. They re-enable it, and then they have computer problems. I fix, wash, rinse, repeat, for the consumer until his money or patience wears out or if it becomes a problem at the corporate level, I just "Block, Lock and Monitor". Whadda they need to be doing going to "Flash Sites" in the first place. What could they possibly learn from that will help the company? PDF's we'll now they ARE used a lot by us, but they have never cause trouble because people don't fool with them unless it's necessary and most PDF's are created "in house". The rest come from sites like irs.gov and places like that while possibly being compromised are not likely to be because who would care? What would they even get except DRM'd Apple music saved to "My Documents" shadowed to the server. God I wish I could clue them in about Apple having non drm'd music, without causing too much trouble. But you know how that is? Sooo.....I predict if Linux becomes real popular for the desktop, then FireFox would be judged by the public to be poor, because it will not work on some weird home town banking site that says it requires IE5. Most smaller places will not switch unless their current setup breaks because of age.

Re:Millions of complacent idiots devastated

[dylan_-]

Take a look at the name of the slashdot user who posted that comment.
Take a look at the name of the person who published the article you linked to.

Re:Millions of complacent idiots devastated

[arminw]

...Macs cost more than Windows PCs....

Yes you do, but apparently they are worth it to millions of happy Mac users. The price you pay for a product is not always related to its value. If you want to get some of your money back that you paid for a Mac, cook some meals at home instead of going to a restaurant and take the money you save and buy some Apple stock. They are doing better financially than any other company that makes junky, cheap Windows computers.

Re:Millions of complacent idiots devastated

[arminw]

...Unless you run your browser in a jail, of course...

Another way to do this of course is to do all your Web browsing on a different user account than where you important Bank information is located. Apple makes this particularly easy with their fast user switching. Also, Safari allows Flash to be turned off in preferences, but it can be turned on if it is really needed. Most websites, especially the really useful ones, work just fine without Flash.

Re:Millions of complacent idiots devastated

[arminw]

...this year's winner rated the difficulty of compromising ...

That is true, but you forgot to mention that he also said that he deems his Mac to be safer because there are very few attacks. For years now, detractors have said that eventually Macs will be compromised as much as PCs as market share increased. Well, the market share of the Mac has doubled in the last few years and yet the number of attacks have not gone up. The biggest reason for that is that attack tools are mostly written for PCs and truly knowledgeable UNIX hackers are in the minority compared to the vast numbers of Windows programmers.

Re:Millions of complacent idiots devastated

[SilverEyes]

I don't think ZDnet gives unbiased Windows reviews...

Re:Millions of complacent idiots devastated

[SilverEyes]

Maybe people are just more interested in the Mac hardware

Re:Millions of complacent idiots devastated

[je ne sais quoi]

I read the linked interview, and then I read a few other related things and while that's certainly cause for concern, the real question is, why do we continually read about windows zombie nets, windows holes, etc.? To my knowledge there has only been one botnet on OS X, and even that required you to download a pirated version of some software and install it --and as far as I know, that vector for attack has been in continuous use for windows machines since windows 3.1.

If Apple has about 8-10% of the usage share of PCs, shouldn't 8-10% of the stories we read be about OS X vulnerabilities? We almost never see them. As others in this thread have noted, this particular vulernability in this article is across the board, linux, os X and windows, so I'll give you that one and that OS X vulnerabilities may be underreported. But I'm not the first to observe this and various theories I've read include that Apple sells more laptops that are inherently mobile thus unattractive to malware writers, the vulnerability writing software hasn't been written for OS X yet, Apple tends to patch things more quickly, and that Apple is more litigious so nobody wants to talk about any found vulnerabilities. I don't think any of these things are really on the mark though. Maybe the virus writers just buy commodity hardware and don't want to bother spending the extra money for a mac.

Re:Millions of complacent idiots devastated

[Blakey Rat]

Despite many years' warnings that Microsoft regards security as a marketing problem and has only ever done the absolute minimum it can get away with, millions of users who click on any rubbish they see in the hope of pictures of female tennis stars having wardrobe malfunctions still fail to believe that taking Windows out on the Internet is like standing bent over in the street in downtown Gomorrah, naked, arse greased up and carrying a flashing neon sign saying "COME AND GET IT."

I was wondering when someone was going to blame Microsoft for a CROSS-PLATFORM exploit in a ADOBE product. Congratulations; you have increased the amount of bullshit on this website.

Re:Millions of complacent idiots devastated

[initdeep]

please tell me you didnt just say that Apple has a monopoly on fast user switching.............

Windows has had this for almost a decade on consumer level OS's....

and Unix for even longer........

Re:Millions of complacent idiots devastated

[initdeep]

if you think you can only infect about 0.0001% of the world's computers with your botnet (which at 6 billion total computers and 90% running windows, would be 540,000 infected computers), why would you aim it for the OS with 8% marketshare? (which using the same numbers would mean a potential of 48,000 infected computers)

it's called ROI.

since it's fairly easy to see that even the largest botnets fall below a million computers, and we are currently running something like 6 BILLION computers (or more) in the world, if i was targeting something to try and get a saleable botnet up and running, Mac OSX wouldn't be it.

hell you're probably better off trying to write something for Linux via apache/php exploits and run it on all those terribly administered hosted webservers than Mac OSX.
(thats not a dig at LAMP, it's a dig at all the lazy admins and users who don't really know what they are doing on hosted accounts and don't keep things up to date or closed down)

Re:Millions of complacent idiots devastated

[initdeep]

if i double something from 1 to 2 and the other option is 10000, does the doubleing really matter?

IF Apple ever approaches 20% marketshare again, you can bet that they will become a viable target.
look at all of the security issues found in firefox now that it has a very good market share.

it becomes more and more open to inspection as the number of people looking grows, and botnet creators are not stupid.
thye are looking to create something and then sell it to people for their use and make money that way.
so go after whatever gives the chance for the MOST computers to use, and that is going to be something with 90% marketshare.

it's simple math

even of the other is less secure, i can get more of the one with 9 times the marketshare....

Re:Millions of complacent idiots devastated

[Super_Z]

2) The annual pwn2own competition, among others, shows that Linux and Windows are similarly secure and OSX is much less secure. OSX goes down first every year, while Windows and Linux both last until later days of the competition when more direct access to the systems is granted to the contestants.

A Windows machine is more likely to be compromised, but that's because of market share. "Insecure by design" implies that you're talking about the security of the OS against someone who wants to compromise it. It's proven every year that only OSX lags in this area, and it lags quite badly (this year's winner rated the difficulty of compromising Vista and Linux as a 9-10, and the difficulty of breaking into OSX as a 3, IIRC).

The CanSecWest Pwn2own competition has been organized 3 times. The first event in 2007 was called "hack-a-Mac" as the competition was about hacking a into MacOSX present on the network. User level access was gained on the second day as the organizers changed the rules and let people try to hack Safari instead as noone succeded in the original contest.

The second 2008 pwn2own contest featured Vista, MacOSX 10.2.5 and Ubuntu. Both the Mac and the Vista computer were hacked into in this contest - the Mac first through a flaw in Safari on the second day and the Vista on the third day through a (windows specific) flaw in Adobe Flash.

The third contest in 2009 focused on browsers. During the first session every browser except Google Chrome were hacked. Safari was the first to be exploited by chance of a draw as contestants where chosen by a random process. IE and Firefox was also hacked at similar stages in this contest.

So - how many times has "OSX" been hacked in the CanSecWest contest? Exactly as many times as Vista or Windows 7 has been.

As for your "quote" - in fact this years winner stated that MacOSX was still the safest operating system.

Now - is CanSecWest a good indicator of whether an OS is "secure" or not? What is usually not stated is that one of the rules of this competition is that no known exploit can be used. Windows can have dozens of zero-day exploits and can yet escape unscathed from this competition. Firefox can have a (hypothetically) stellar security history and yet be "hacked in seconds". Claiming security based on these rules are exceedingly stupid.

So your hateboy statement that "It's proven every year that only OSX lags in this area" is simply disingenuous.

What is shocking though is that your post - which is so full of actual faults and reeks of hateboyism - gets modded +5 insightful. I guess it is a good indicator of the current sorry state of Slashdot.

Re:Millions of complacent idiots devastated

[slashdime]

Unix users have privelege separation.

which protects the uninteresting, easy to reinstall OS and apps, and leaves your important data swinging naked in the wind.

Unless you run your browser in a jail, of course.

What is this? 1980? Kids write virii today to wipe our hard drives right? Botnets work toward the day when eventually they control >99% of the world's computer and then one day, they all rm -rf / right? The responsibility is on you to protect your files. Yeah, it's really easy to protect all your data, just sudo and move it to a directory you don't have write permission on. Or if you're worried about it being *sensitive* data, don't give yourself read permission either. Then just sudo whenever you want to view pictures of your wife.

Re:Millions of complacent idiots devastated

[1s44c]

1) This vulnerability exists on OSX, Windows, and Linux.

This vulnerability is in flash. This vulnerability isn't indicative of the behavior of all vulnerabilities.

2) The annual pwn2own competition, among others, shows that Linux and Windows are similarly secure and OSX is much less secure. OSX goes down first every year, while Windows and Linux both last until later days of the competition when more direct access to the systems is granted to the contestants.

This test isn't real life.

A Windows machine is more likely to be compromised, but that's because of market share.

This is a myth. Market share doesn't make windows a weak OS, poor coding and testing does. Microsoft make far more money than any other OS vendor, they should have a vastly greater coding and testing budget too. Microsoft don't take security too seriously because they have little commercial pressure to improve things.

I'll bet you the market share of some embedded OS's is way higher than Microsoft's but how many virii attack things like nokia phones? Not many..

Re:Millions of complacent idiots devastated

[rantingkitten]

2) The annual pwn2own competition, among others, shows that Linux and Windows are similarly secure and OSX is much less secure. OSX goes down first every year, while Windows and Linux both last until later days of the competition when more direct access to the systems is granted to the contestants.

First, I don't understand why this myth keeps appearing. Ubuntu is the only one that came out without being cracked.

Second, pwn2own shows what can happen if someone specifically targets your machine. No system is unbreakable to a truly determined and resourceful attacker, and nobody claims Linux is magically untouchable to such a concerted effort.

But that kind of targetted attack is not really what people care about when talking about general desktop security, is it? Nobody is targetting your mother's Windows machine, specifically. Her machine gets infected because trojans, viruses, and other malware is absurdly easy to pick up on the Windows platform just by going about her day to day work.

The thousands of exploits and vectors documented in Windows are of far more consequence to the average user than a focussed attack by a dedicated hacker deliberately trying to get into that specific machine. pwn2own demonstrates the latter threat, which is of no real concern to most users. It says nothing about the former threat, by far the more dangerous.

A Windows machine is more likely to be compromised, but that's because of market share.

This is such a tired argument. There are millions of LAMP stacks out there sitting on fat pipes. You think hackers and spammers wouldn't love to get their hands on those? The ones under my control get hammered all day, every day.

"Market Share" has nothing to do with the primary vector I notice plagues users either: Getting new apps. In any modern "desktop" disto, you get software out of a respository, which has been examined, vetted, and verified. If something's wrong with the package it won't get into the repo, and if it does, someone's going to notice quickly. It's not 100% foolproof but it's pretty damned great.

But Windows users don't have that option. Instead they scour the web looking for software which might do what they want, sift through the crippled versions, the trial versions, etc, and download a compeltely unknown binary from an unknown source, and run it. BIG SURPRISE, many of these come bundled with little extras -- trojans, adware, toolbars, and other party favors. Next thing you know the hapless Windows user is calling you to complain about how slow their computer is...

This is not a marketshare issue, it is one of many fundamental differences in the approach and structure of Windows versus Linux. If some genie made it such that Ubuntu had 90% marketshare tomorrow, that 90% of users would still be using Synaptic, and the 10% Windows users would still be downloading random executables from the web.

1) This vulnerability exists on OSX, Windows, and Linux.

As far as I can tell it exists on any platform where Flash is installed. It's not really an OS problem (though this is debatable, I guess), but an application problem. Though, the Zealot in me just has to point out that this is what happens when you deal with closed software. Now we're all waiting around twiddling our thumbs hoping Adobe will get off their butts and do something about this, because nobody else can.

Re:Millions of complacent idiots devastated

[arminw]

...if i double something from 1 to 2 and the other option is 10000...

Something that is more secure is not necessarily safer. $1 million in a safe in a bad section of town may be more secure but less safe than that same million dollars in a cardboard box in a remote mountain cabin. It does not really matter why Macs are safer, but the simple fact is that currently they are. It does not really matter that my house does not get burglarized for whatever reason, but the simple fact is that it does not get burglarized. There is a difference between safety and security. Something may be totally safe and yet completely insecure.

Re:Millions of complacent idiots devastated

[Viol8]

Yeah , the backup is called the installation DVD you moron.

Re:I haveth 10...87 but I feareth not !!

[noundi]

You should get that lisp checked out.

A more general statement ...

[neonprimetime]

9 out of every 10 Windows users are vulnerable to the XXXXXX vulnerability.

Sad, yes. News? No.

[93 Escort Wagon]

Flash is installed on almost every PC. The large majority of Windows users still use Internet Explorer, so the majority right there are vulnerable. Firefox has a respectable percentage of the user base, but very few of those people (outside of the Slashdot crowd) seem to use tools like Flashblock. The other browsers - Chrome, Safari, Opera round out the group; their users are pretty much all vulnerable too.

It's sad, I agree - but we already knew this was the case since we've known about this unpatched flaw for a while now...

Re:Sad, yes. News? No.

[The_mad_linguist]

Well, given that it's possible to avoid Flashblock just by lying to the browser (since FF3 doesn't do much MIME checking), installing it really doesn't help security significantly.

Killer App

[HaaPoo]

This gives a new meaning to the term Killer App

If only I had a mod point...

[Mr. Firewall]

Well at least the iPhone is safe

+1 Funny!

Horseshit.

[Anonymous Coward]

If it were an actual mistake, then I would agree with you. It wasn't an error.

He purposefully did it and when he got caught he then apologized for it. What I'm saying is, if nobody said anything, he'd still be doing it.

Re:Horseshit.

[causality]

If it were an actual mistake, then I would agree with you. It wasn't an error.

He purposefully did it and when he got caught he then apologized for it. What I'm saying is, if nobody said anything, he'd still be doing it.

This is a hard thing to understand and you raise a very valid question. I hope to answer that without just dismissing it or pretending like it isn't important. I don't know the man personally and have to go by what he and others have written, so please consider this just my opinion as I cannot speak for him.

You are right that he deliberately coded the functionality that made unauthorized and underhanded modifications of another, unrelated add-on (ABP). The mistake or error was in believing that the ends justify the means, that there is ever a good reason to do such a thing. All improper actions he took were rooted in that one error. But not for that belief, he would have probably regarded the temptation as "what the hell, I can't do that." Sometimes people get lucky and they see what's wrong with such an error on their own, before anything has to blow up in their face. Other times they have to see for themselves why it's harmful, often by being harmed by it or harming others by it, before their regret at having spectacularly failed reveals the error of their ways. It's sort of like the religious idea of "forgive them because they know not what they do," though if you asked them what they were doing they could describe their behavior accurately -- this is not really a contradiction.

I'm not an impeccably perfect person either. I have had to learn some lessons the hard way and I suspect every other human being could say the same. So no, I don't share the willingness to condemn someone who has fully come clean and has turned away from what he was doing. I think doing that would say more about me than about him. If anything, I celebrate his courage and wish it were more common.

Re:Horseshit.

[causality]

How is that Offtopic? It's exactly spot on. Mod parent up, if you're not Noscript shill.

Agreed. Mods, please promote the GP post. This really should be discussed and resolved.

I also disagree with the GP but censoring him is not the Way. I do think it is akin to censorship because nothing he said is detrimental to the discussion. Also, a lot of people feel the way that he does and they should have their say. At least, this is what I believe. I have written a post describing why I disagree and why I think there is a better way to handle the situation. I think that in an open discussion, the truth will win out, and on this one I also believe that I have summarized the truth of the matter. If I'm wrong about that, modding down the "other side" of the discussion will not help me to discover where I have erred.

Re:Horseshit.

[Abstrackt]

I'm not sure about you, but I think most of the people using NoScript do it because they want to see the Internet on their own terms rather than someone elses.

While I respect that the author of NoScript had the courage to publicly admit he did something that really wasn't a good idea, the fact remains that he abused the trust people have (or had) in him.

Re:Horseshit.

[Mister Whirly]

Do you use the product? Did you donate any money to the author? If enough people that used his software had sent him money, he wouldn't have needed to sell ads. (Because last time I checked, naïve ideals are not accepted as a form of payment for bills.)

Re:Horseshit.

[Abstrackt]

I don't use his software, I never said I did. Care to point out how that makes me a hypocrite?

Like I said, I respect that he owned up to his error of judgment but you can't change the fact that he abused the trust he was given in the first place.

Re:Horseshit.

[owlstead]

It was a mistake but it was probably a personal mistake, not a technical one. You've got something to learn if you don't understand this.

Not just Windows

[ThrowAwaySociety]

"A critical vulnerability exists in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems" (emphasis added.)

TFA only mentions Windows because they don't bother scanning Macs or Linux boxes.

Re:Not just Windows

[dhavleak]

It's possible (even likely) that the compromised sites mentioned in TFA only have payloads that exploit windows boxes.

It's proof positive of the theory that no OS/browser/plugin/software-in-general is immune to security issues. Windows is the the main target - that's all..

Re:Not just Windows

[cenc]

Has anyone tested this exploit? Some frigin security company claiming macs and Linux are vulnerable is no help. Can anyone document a case or two of this exploit actually doing anything in Linux or the Mac?

I hate Adobe

[Anonymous Coward]

You know ...

I hate Adobe software.

There, I said it.

Photoshop is buggy. Premiere is often weird and arcane. Flash and Reader have had some NASTY security holes of late. Reader is a painfully source resource pig. Adobe is at least a year late in releasing a 64 bit version of Flash (outside of the Linux beta).

You know you're in trouble when freakin' MicroSoft is putting out better software.

Adobe's releasing one awful update after another. They seem to lack the resources and expertise to maintain a huge portfolio of overly-ambitious software on a wide variety of platforms. They just can't seem to get anything right with their free (as in beer) software from a security, and sometimes even usability, standpoint.

Dear god.

Request to Adobe: if you want to be the gateway for rich content on the 'net, please realize what's at stake if you fsck things up. By botching security, you're putting millions of people at risk for having their lives turned upside down by thieves and fraudsters. You're releasing the digital equivalent of Pintos. Please start fixing your mess.

Re:I hate Adobe

[Nightspirit]

I just installed Windows 7 RTM and went to install flash for IE8 (for steam) and Adobe installed a download manager just to install flash. Are they retarded or something? I wish I could ditch Adobe flash for an alternative. I'm already 100% free of Apple software, it would be nice to coup de grace Adobe from my system as well.

Re:I hate Adobe

[Blakey Rat]

Security holes or no, have you tried using Flash lately? (The IDE/Designer, not the player.) Dear God, CS3 and CS4 have AWFUL UIs. It's like they just took Macromedia's already-pretty-goddamned-bad UI and just plastered shit all over the top of it.

Re:I hate Adobe

[Hatta]

Photoshop is buggy. Premiere is often weird and arcane. Flash and Reader have had some NASTY security holes of late. Reader is a painfully source resource pig. Adobe is at least a year late in releasing a 64 bit version of Flash (outside of the Linux beta).

And yet their houses have lasted for thousands of years. Wait, what?

Re:I hate Adobe

[Kalriath]

Funny, you'd bitch and whine if Microsoft just went along and installed any ActiveX control that wants it without asking.

Let me recap the steps to install an ActiveX control on Windows:

Click the info bar (because you don't want dialogs just popping up obscuring your work - that's Flash's job)
Click Continue to the prompt warning you that IE has to elevate to do this (if the ActiveX control has a manifest demanding install for all users - Flash does)
Click Continue to the "This comes from Adobe. Install it? You can also always trust this publisher and we'll never ask you again before installing anything cryptographically signed by this company" prompt.

There. I counted the security warnings: 1. The other dialogs: 1. If it's from a trusted company, only the first dialog will appear.

Now. How does it work on Firefox I wonder?

Click on the "Additional plugins are needed to display media on this page" message. Click Next. Click Next again. Read message telling you that Firefox can't auto-install this. Click finish. Adobe web page opens. Click Download. Click Save (because Open is disabled on EXEs). Wait for download. Double click download. Click Open File. Click Run. Click Next. Click Next. Click Finish. Close Firefox. Open Firefox. Reopen web page you wanted to go to. Media plays!

Adobe Flash security is extremely disappointing

[quazee]

Flash is now among the top attack vectors for Windows, and it isn't even covered by Windows Update.
There were 23 reported security issues in the last 2 years, including at least 4 browse-and-get-owned vulnerabilities.
In comparison, Silverlight has had no security bulletins since its 1.0 release (it's now at 3.0).
This may be just yet another reason to migrate to Silverlight, especially for intranet applications.

Re:Adobe Flash security is extremely disappointing

[recoiledsnake]

Flash's record is pretty bad, but Silverlight hasn't been completed tested out in the wild yet because it's not very popular right now. More exploits might be coming as it gets used more. But MS seems to have developed it with security in mind, so let's see what happens.

Re:Adobe Flash security is extremely disappointing

[jpmorgan]

Well, it's unsurprising Silverlight doesn't have any vulnerabilities. Flash runs in its own, custom built virtual machine. Silverlight runs in the .NET virtual machine, which is designed with a sandbox at its core, and generally has been much, much more rigorously audited and tested.

Re:Adobe Flash security is extremely disappointing

[Ilgaz]

So, MS jumps 3 versions in matter of 2 years, dropping PowerPC support and never intending to support Linux except hired open source cloning monkeys method and you claim it is 3rd generation software with no known threats?

Guess what, DejaVu viewer has no known security issues too.

Once upon a time, MS puppets were doing their dirty job with more clever methods.

Re:Adobe Flash security is extremely disappointing

[Mr 44]

Window's record is pretty bad, but Mac OSX hasn't been completed tested out in the wild yet because it's not very popular right now. More exploits might be coming as it gets used more. But Apple seems to have developed it with security in mind, so let's see what happens.

Re:Adobe Flash security is extremely disappointing

[thisnamestoolong]

ANY piece of software is going to have vulnerabilities -- and the more widespread it is the more people are going to strive to find those vulnerabilities. Silverlight will be no different if it takes over. The "security" of a piece of software is directly related to how diligent the devs are in patching holes. With closed source software, this is an extremely intensive process, so Silverlight is bound to be every bit as bad as Flash. Open source will ALWAYS be more secure, as you can have millions of eyes scanning the lowest level of the code to find and fix vulnerabilities, rather than having to rely on an extremely inefficient top-down procedure.

Re:Adobe Flash security is extremely disappointing

[Ilgaz]

The day there is a Silverlight issue (if it doesn't get scraped), I will remember this message.

Even Java, completely designed around sandboxed virtual machine idea and even invented it had security vulnerabilities.

Hope you guys are getting paid to post these bullshit.

Re:Adobe Flash security is extremely disappointing

[shutdown -p now]

Well, it's unsurprising Silverlight doesn't have any vulnerabilities. Flash runs in its own, custom built virtual machine. Silverlight runs in the .NET virtual machine, which is designed with a sandbox at its core, and generally has been much, much more rigorously audited and tested.

I have no idea about Silverlight vulnerability track record, but I can assure you that full .NET sandbox can and was successfully broken. I've personally discovered one way to corrupt the stack and execute arbitrary native code from a sandboxed application (such as a WPF browser app). That particular vulnerability has been fixed, and does not affect Silverlight anyway, but it serves as a reminder that VM sandboxes aren't perfect. Java also had its share of problems in that regard (though IIRC .NET had far less than Java did, especially early on).

Re:Adobe Flash security is extremely disappointing

[Actually, I do RTFA]

I remember when I could bring down an OS X machine in Flash 8. It's not just Windows, it's not just recently, and it's not just Adobe (see Macromedia).

Re:Adobe Flash security is extremely disappointing

[recoiledsnake]

Window's record is pretty bad, but Mac OSX hasn't been completed tested out in the wild yet because it's not very popular right now. More exploits might be coming as it gets used more. But Apple seems to have developed it with security in mind, so let's see what happens.

Wrong. http://blogs.zdnet.com/security/?p=2748

Pwn2Own hacker: Apple Safari is 'easy pickings'

Re:Adobe Flash security is extremely disappointing

[recoiledsnake]

Umm, I never said there won't be any issues with Silverlight. In fact I bet there would be. My point is that MS seems to have finally woken up to security threats and is trying to clean up by having proper security audits to avoid many(NOT ALL) security holes. For example: http://cplus.about.com/b/2009/05/15/microsoft-security-and-cc-programming.htm http://tech.slashdot.org/article.pl?sid=09/05/15/152213 This seems to be paying dividends with Vista, most of the security holes discussed over the past few weeks either flat out don't work on Vista or trigger a UAC prompt. Adobe has yet to do something like this. That's my whole point. Now if you argue that I am a (paid) shill, I have nothing to say but point you to this http://linux.slashdot.org/story/09/07/25/1757253/Linus-Calls-Microsoft-Hatred-a-Disease

Re:Adobe Flash security is extremely disappointing

[quazee]

No, it doesn't.
Windows XP originally came with Macromedia Flash Player 5 (http://www.adobe.com/macromedia/proom/pr/2001/fp5_msxp.html)
This Microsoft update only applies to this ancient Flash Player distributed with Windows XP as a part of that agreement (versions 5 and 6).

Re:Adobe Flash security is extremely disappointing

[Ilgaz]

It seems "diseased" people which naive Linus talks about were right.

As you point to that story, I point to this story.
http://news.slashdot.org/article.pl?sid=09/07/28/0045229

MS hasn't changed and won't change until they see the "GM" times on the horizon. That would be a bit late of course. Stop acting like they have changed. UAC is NOT security, it even added more to insecurity by making people more ignorant to security alerts.

Re:Adobe Flash security is extremely disappointing

[Macthorpe]

What does your link or any of your post have to do with security?

Your disease has made you delusional.

Re:Adobe Flash security is extremely disappointing

[Mathonwy]

Silverlight doesn't have any reported issues since not enough people use it for the bad guys to bother investing resources in finding its vulnerabilities. It's related to the same "macs don't get viruses" argument that was floated around right up until the point that macs became popular enough for virus writers to bother with them.

Re:Adobe Flash security is extremely disappointing

[Kalriath]

UAC is as secure as sudo, or OS X's escalation dialog. Actually, it's slightly less secure than OS X's, as OS X also wants your password. Unless the OS X window runs in the user desktop context (i.e. easily keylogged) in which case it's less secure.

Re:Adobe Flash security is extremely disappointing

[quazee]

> Can you explain how installing a second separate program improves security in the first? For intranet applications, it may make sense.
If your intranet does not use Flash, you can avoid rolling out Flash in your corporate network in the first place, thus reducing potential attack surface.
Of course, there is still YouTube, news sites, etc., so this is only applicable in highly restricted workplaces where users aren't supposed to complain about that.

versions of Flash Player - 9.0.159.0 and 10.0.22.8

[buchner.johannes]

An interesting approach, using IP addresses as version numbers

Admin?

[wiredlogic]

So do you have to be on an administrator account for the attack to work?

Re:Admin?

[mjwx]

So do you have to be on an administrator account for the attack to work?

So do you have to be on an administrator account to install Flash?

Re:versions of Flash Player - 9.0.159.0 and 10.0.2

[Icegryphon]

IBM Corporation - 9.0.159.0
Internet Assigned Numbers Authority - 10.0.22.8
Tinfoil hats now half off.

How can it still be a zero day exploit...

[Viol8]

... if everyone knows about it?

Or am I missing something here?

Re:How can it still be a zero day exploit...

[bigpresh]

[How can it still be a zero day exploit]...if everyone knows about it?

Being an attack against a vulnerability for which a patch has not yet been released qualifies it as a 0-day attack.

From Wikipedia's Zero day attack article:

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit computer application vulnerabilities that are unknown to others, undisclosed to the software vendor, or for which no security fix is available.

(Of course, one security fix is available: disable Flash, or use Flashblock :) )

Re:How can it still be a zero day exploit...

[onefriedrice]

From Wikiepedia:

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit computer application vulnerabilities that are unknown to others, undisclosed to the software vendor, or for which no security fix is available.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Once you're penetrated...

[argent]

Privilege separation is a useful tool, but minimizing the surface area for the initial attack is critical. Security is like sex, once you're penetrated, you're ****ed.

The biggest problems Windows has are related to the surface area exposed to attack:

1. The lack of the ability to bind most survices to a specific IP address means that even services intended for internal use have to be blocked by a firewall rather than being bound to 127.0.0.1.

2. The lack of ability to pass parameters to a program without passing through a re-parsing step, leading to quoting attacks against helper applications.

3. ActiveX.

4. ActiveX.

5. The use of a common set of helper application bindings for the shell and browser, a vulnerability alas copied by Apple.

6. Did I mention ActiveX?

Windows has privilege separation issues, but not nearly as great as they used to, so I wouldn't put this even in the top 10 security problems.

Common runtimes, like Flash, Silverlight, and Java, are a problem because they create the possibility of a "one size fits all" attack. You shouldn't ignore the danger whether you're running Windows or UNIX.

Re:Once you're penetrated...

[argent]

Unlike Unix, sockets are not a common method of IPC on windows (except in apps written by unix developers). It is a vulnerable design in the first place that two programs on the same machine would communicate in a way that allows network access by default.

Of course they're not using sockets, they're using Lan Manager named pipes. The problem is that once they bound NetBIOS to TCP/IP ports, all the local NetBIOS traffic (and yes, Microsoft services and applications were written to use it internally) was exposed to the Internet.

Isn't that a good thing for the receiving app to re-validate the data?

I'm not talking about *re*validating the data, I'm talking about the requirement for re-quoting and re-parsing atomic command line objects using the same quoting conventions. In UNIX, this only happens when an applications uses the system(3) library function to run an application instead of an exec[lv]-family call. The use of system() has been systematically deprecated for any application that needs to handle untrusted data for decades. In Windows, there's no way to call 'echo "Hello \"World\""' without knowing how echo is going to parse quotes. In UNIX, you call 'execl("/bin/echo", "echo", "Hello\"World\"", NULL);' and you're guaranteed that echo is going to see a single argument, 'Hello "World"', because the API never quotes and reparses it.

The remaining 8% of Windows PC

[gmuslera]

were turned off at the moment of the counting.

Let me guess

[mandark1967]

The other 8% were:

1 -- Downloading Flash because they felt "left out"
2 -- Powered off
3 -- Already infected
4 -- At the local Geek Squad store having their Owners' Personal Information "backed up" to the technician's USB stick (It's value-added!)
5 -- Some combination of the above choices

Could this be....

[wjousts]

the best thing to ever happen to Silverlight?

Re:Could this be....

[Ilgaz]

Well, it seems MS billions already sunk in Silverlight as nobody, including Windows users doesn't seem to care if it exists or not.

So yes, a BLACK HAT ZERO DAY security exploit may buy some months for Silverlight. All Silverlight and Moonlight developers must be THANKFUL to that mafia guys exploiting a zero day bug in expense of putting billion end users at risk. We must all congratulate them in their hideouts, thanks for stealing end user information, you did a great service for MS born dead technology...

So true

[Ilgaz]

Yes, who are they to support all platforms in equal manner allowing same functionality in all sites?

My suggestions are:
1) Drop PowerPC support
2) Drop Linux support
3) Find some sold out once open source heroes to implement half ass functional thing with a cool name.
4) Go mono! err.. profit!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Vulnerabilities disseminated as Haiku

[mandark1967]

I visit a site
It uses Flash 10 Player
I am truly fucked

Oh please

[Sycraft-fu]

Let's not let the facts get in the way of rabid fanboyism! After all, Linux is 100%, completely secure! There are magical GPL fairies in the kernel that protect it from any and all attacks, even when the app in question is from a 3rd party.

Re:Oh please

[Yvan256]

There are magical GPL fairies in the kernel that protect it from any and all attacks, even when the app in question is from a 3rd party.

That's good to know!

Re:Oh please

[teg]

Let's not let the facts get in the way of rabid fanboyism! After all, Linux is 100%, completely secure! There are magical GPL fairies in the kernel that protect it from any and all attacks, even when the app in question is from a 3rd party.

Maybe not fairies, but you do have mechanisms like SElinux - which can run web browser plugins in a confined mode.

Re:Oh please

[caluml]

After all, Linux is 100%, completely secure!

/troll-yet-true
This isn't a bug in Linux.

Can we have a break from .NET monkeys?

[Ilgaz]

When there is a zero day issue exploited in the wild and if it is effecting near billion computers, some questions must be asked.

1) Will the FBI and security organizations look to this matter as a threat to global security and this time, actually find the gang to question them?

2) When did we start supporting zero day exploiting black hat mafia?

3) Who is really behind this?

4) Why would it take until Tuesday to fix the issue? Can't they provide a quick hotfix until Tuesday and ship the real thing with more testing with 1 week later?

5) Will Adobe do some serious internal investigation, working with the law enforcement agencies to find out the root cause of this issue, this kind of behavior among their developers, team leaders and testers?

Some company known to work in a very dirty ways when it got cornered is at version 3 of their software and nobody, including their media puppets seems to care. Just saying...

Re:Can we have a break from .NET monkeys?

[stewbacca]

Why do you think Adobe has any responsibility in issuing a speedy patch? As far as I cant tell, the only thing motivating Adobe to make a patch would be to prevent any negative PR that could cost them in profits. In lack of said negative PR, why would they spend a dime fixing it?

Very Very Intersting

[EvilBudMan]

So, are you saying Windows is not done until Adobe is broke, so that people will use M$ stuff instead? They have done that before. I don't think Adobe is at fault, since the same problem appears many times for them, but no issues on Silverlight. Interesting, Adobe works on the Mac and Linux flawlessly. So it's got to be the evil empire again. Look out for the fine they are going to get now. WOW.

Flashblock won't do anything

[Little_Professor]

Flashblock will not save you from this vulnerability. Flashblock only blocks flash objects in your internet browser (firefox/seamonkey.) This attack uses flash objects embedded in pdf documents which are handled by Adobe Reader. Now, who decided it was a good idea to allow pdf documents to have flash embedded in them?

Does this affect us who never upgraded from 7/8?

[PurplePhase]

Does this affect us who never upgraded from 7/8?

So will this be caught by AV?

[kalirion]

This is something that can be detected and stopped by Antivirus software, right? Since my Avast! updates every day, if it can protect me against this Flash vulnerability, then it shouldn't matter to me when Adobe issues the patch.

One Large Problem

[weston]

This may be just yet another reason to migrate to Silverlight, especially for intranet applications.

Other than the large security problem of handing Microsoft any degree of weight in the market for internet clients.

Particularly given Microsoft's history, which suggests they barely have the slightest idea of how to create anything secure, chances are that Silverlight's record has a lot to do with its small market share.

But mostly, they're simple not trustworthy. We saw what they did with IE6. Even if you ignore the rest of their history, trusting them is foolish.

Kill button

[Well-Fed Troll]

Adobe should give a notification in their updater that their software is insecure, and give the option to disable it until the next patch. Quarantine is usually the immediate response to an outbreak before we have a suitable vaccine.

Re:Kill button

[Ilgaz]

a very quick solution exists, quickly packaging a flash version which does not have that functionality which is exploited. So, everyone would be happy.

Completely disabling flash could even hurt global economy at this stage.

People typing "oh I hate flash anyway", "I got flashblock" are really missing the significance of the issue. This issue, if really being exploited right now is putting entire net on risk. As we all know every single software may have zero day issue, it is not about "lets go silverlight" or using it as an agenda to spam about it.

That little gang (or gangs) have put the planet on risk. The idiots at Adobe who never thought about this potential (it is obvious) have put both planet and adobe itself at risk. This is not a issue which can be "oh it is fixed". Its reasons must be investigated really deeply, at potential crime, trade secret leak and possible economy breakage levels.

Flash and PDF are both disasters

[hessian]

These bloated plugins seem to also be responsible for 80%-ish of the crashes I have in Mozilla.

They are the big weakness of the web: what if someone decides to start putting a non-standard format out there that becomes a de facto standard because it's the easiest way to do something?

Flash seems to be the easiest way to put up an animation.

PDF is the best format for distributing documents that you don't necessarily want others to edit.

No one wants to explore alternatives because the content is in these somewhat unwieldy formats.

I'm beginning to suspect Flash as my problem.

[Xilinx_guy]

I noticed in early July that my Kubuntu 8.10 machine started showing corruption in the EXT3 filesystems, and it seemed to happen everytime I used Firefox (which had Flash installed). I finally got so sick of restoring from backups that I rebuilt a totally new Kubuntu 9.04 image, without Firefox. I now run Firefox in VirtualBox, using a sandboxed image of Kubuntu 9.04. This has stopped the filesystem corruption in the host OS, but I continue to see EXT3 corruption in the sandboxed Firefox with Flash. It's beginning to look very sensible to use 3 virtual machines for browsing the web now. Green Sandbox for just my banks. Yellow Sandbox for email and Paypal, and Red Sandbox for everything else (including Slashdot). Even with Noscript, the Red Sandbox gets dirty still, and needs rolling back to the initial snapshot. I haven't run rootkit detection or virus scanning yet, but I'm beginning to believe that integrated intrusion detection will be the next Great Thing (tm) for virtual machines. Charlie Stross thought about this years ago in Accelerando. It's worth a read.

Re:I'm beginning to suspect Flash as my problem.

[cenc]

It is called a honey pot. Not very new.

Shithorse.

[Ihmhi]

Yes he did, but he's not some huge, evil megacorporation. He's one guy who has cooked up this software that everybody wants to use, isn't he?

His only mistake was not telling people in the first place - not the whole whitelist/redirect thing. If you want to use NoScript than obviously a condition of that use is that the NoScript site is automatically whitelisted and the page opens up every time you have an update. For all of the benefits it gives one that is an awfully generous tradeoff.

Re:Does this affect us who never upgraded from 7/8

[bazorg]

I don't know if it does, but I would certainly like to know the secret to living with Flash 7 when everyone and their uncle check the version of Flash before allowing me in to their website. Is there a way to declare a different version instead of updating something that is (was) actually working fine?

92% if Windows PCs vulnerable

[Runaway1956]

I stopped reading there. Obviously a slow news day.

Re:92% if Windows PCs vulnerable

[1s44c]

I stopped reading there. Obviously a slow news day.

8% of windows PCs are not vulnerable. That's newsworthy.

Flash should be replaced

[1s44c]

Flash is a ongoing security nightmare. Users demand the functionality but don't understand or care about the security cost.

Flash is one abomination that should be put out of its misery ASAP.

Security through Diversity

[cenc]

I would highly suspect by now the entire eco-system involved in an average patch in FOSS software is very much outstripping the resources of MS. At least on the eyeball side. What does MS put at any given problem a few hundred or a few thousand programmers? Yea, there might be a whole lot more people in the marketing spin department, but they don't really count as helpful.

It is not just the guys around one project, a particular writer in FOSS that vets the patch. It is the entire community of hundreds of different distros, sub-projects, individual users, and so on that vet a patch or change and decide to include it, ignore it, put it on the shelf, and push changes back up the food chain as problems are found.

I consider myself to be fairly much an end user of FOSS, but perhaps leaning more on the power users side of things. I remember a bug in a early development release of Firefox I found. From the time it was released, to the time I found it, verified it, and went to report it, was less than 30 mins. Guess what? 100 other people found it, 10 proposed patches had been submitted, and the best was already accepted and in to the next version a full 15 mins earlier than me. That is just normal in FOSS.

No one can tell me a company with massive bureaucracy of rules and procedures would be able to mobilize anything at that speed. It likly takes them a week just to get authorization to look at the source code they wrote from the legal department.

Actually, Secunia reports 4 browsers insecure

[mschuyler]

This is not so much a Windows issue as it is a browser issue. Secunia reports MSIE7, Mozilla, Chrome, and Opera ALL insecure for browsing for the same reasons: Flash, Adobe Reader, and Sun Java being the consistently prime culprits, but it also reports MSIE 7 and Mozilla as unsecure all by themselves.

Secunia is an interesting program in many ways, but it reports 'vulnerabilities' as soon as anyone releases a new version of anything. Suddenly, you are 'insecure.'

Regardless, Secunia is well worth taking a look at. http://www.secunia.com/

Re:Let's review MacOS X vs. Windows Server 2003...

[tgv]

You read the numbers in a weird way. The pages of Secunia say:

- Secunia has issued a total of 193 Secunia advisories in 2003-2009 for Microsoft Windows Server 2003 Enterprise Edition. Currently, 6% (12 out of 193) are marked as unpatched with the most severe being rated Less critical
- Secunia has issued a total of 130 Secunia advisories in 2003-2009 for Apple Macintosh OS X. Currently, 4% (5 out of 130) are marked as unpatched with the most severe being rated Moderately critical

At least on OSX, the most critical vulnerability requires you to download and mount a malcrafted disk image, which most likely can only crash your system, and perhaps expose kernel memory.

Furthermore, it is 4 against 12 unpatched (in favor of OSX), and of course the other Windows systems (XP, Vista, 7) have got a different set of vulnerabilities. And your language and mark-up suggest mild paranoia. You have not been attacked, and the Pravda doesn't deal with Windows viruses. Get treatment, or move to Montana and join the militia.

Re:Care to show us your PHD in Psych?

[Super_Z]

Did I? Funny, 971 vulnerabilities over time in MacOS X is a heck of a lot more than the 240 for Windows Server 2003, over time (both reported as the # of vulnerabilities found in each, so, how did I "read that funny"? It's there, in black & white, lol)... first of all!

1. You are comparing the aggregate of security vulnerabilities of OSX 10.0, 10.0 Server, 10.1, 10.1 Server, 10.2, 10.2 Server, 10.3, 10.3 Server, 10.4, 10.4 Server, 10.5 and 10.5 Server to Windows Server 2003. Feel free to add the vulnerabilities of the other Windows Desktop and Server releases from 1999 and onwards.

2. Apple and Microsoft shipped software have different disclosure policies. Microsoft never patches until they are forced to (witness the 18 month lead time on the ActiveX vulnerability just disclosed). MacOSX includes software that have "disclose everything now" policies.

3. MacOSX simply bundles more software than Windows Server. A quick look at the MacOSX advisories show that they include vulnerabilities in Python, Perl, PHP, Ruby, Java, ClamAV, SquirrelMail, X11, Apache, BIND, OpenSSL, OpenLDAP, MySQL, Flash etc.

Secunia writes:

PLEASE NOTE: The statistics provided should NOT be used to compare the overall security of products against one another. It is IMPORTANT to understand what the below comments mean when using the statistics, especially when using the statistics to compare the vulnerability aspects of different products.
It should also be noted that some operating systems (e.g. certain Linux distributions) bundle together a large number of software packages, and are therefore affected by vulnerabilities, which do not affect other operating systems (e.g. Microsoft Windows) that don't bundle together a similar amount of software packages."

4. Secunia has some weird counting going on. Check out the XP Professional 2009 advisory page. I count 25 vulnerabilities in 12 advisories - yet the total statistics claim 244 advisories with 253 vulnerabilities. If the numbers are to add up, previous years would have to have more advisories than vulnerabilities.

Re:"And now, YOUNG JEDI? You WILL die..."

[Super_Z]

whereas there is NOT A SINGLE ONE on Windows Server 2003 [..] I cannot fix... or, avoid

So - you cherry-picked a release and even this one has several unpatched and known exploits in it? Congratulations!

WHAT? Apparently, you aren't aware of the JAVA bug that Apple had, for MONTHS now, that other vendors patched many, Many, MANY months ago... would you like proof of THAT, also?? Just ask... I'll get the link, & right from this website...

http://blogs.zdnet.com/security/?p=1708 http://zerodayinitiative.com/advisories/upcoming/

Windows runs more software AND ON MORE HARDWARES in peripherals

Whether Windows can run loads of software is irrelevant. If it did not ship with it - it will not get counted as a flaw.

As for your last comment - you just don't get it do you?

Comment removed

[account_deleted]

Comment removed based on user account deletion