Slashdot Mirror
92% of Windows PCs Vulnerable To Zero-Day Attacks On Flash
CWmike writes "More than 9 out of every 10 Windows users are vulnerable to the Flash zero-day vulnerability that Adobe won't patch until Thursday, Danish security company Secunia says. According to Secunia, 92% of the 900,000 users who have recently run the company's Personal Software Inspector (PSI) utility have Flash Player 10 on their PCs, while 31% have Flash Player 9. (The total exceeds 100% because some users have installed both.) The most-current versions of Flash Player — 9.0.159.0 and 10.0.22.87) — are vulnerable to hackers conducting drive-by attacks hosted on malicious and legitimate-but-compromised sites. Antivirus vendors have reported hundreds, in some cases thousands, of sites launching drive-bys against Flash."
The noscript author is an assclown who silently enables ads (And disables noscript) for his own financial advantage.
Sounds like someone doesn't keep current on events, as this problem was worked on some months ago.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
The fix to all Flash problems lies here on Adobe's own web site: How to uninstall the Adobe Flash Player plug-in and ActiveX control.
The noscript author is an assclown who silently enables ads (And disables noscript) for his own financial advantage.
He admitted his error and has stopped doing this. See this link. The very first line? "I screwed up. Big time."
Any fool can make a mistake. It takes some guts to admit it, correct it, and try to move on especially in public like that. For that reason I do not count myself among the folks who still want to figuratively crucify him.
It is a miracle that curiosity survives formal education. - Einstein
Capable? I'm sure they could, I just get the distinct feeling that they don't feel like doing it. Which would be fairly typical, MS for instance likes to get angry when people mention the fact that they've been taking months to patch a serious vulnerability. Admittedly you don't want a patch to cause another vulnerability, but how long does it really take to get a proper fix?
If the FOSS community is any indication, it takes anywhere from a few hours to a couple of days after the vulnerability is disclosed.
I am surprised how Microsoft often gets a pass on these issues, considering the vast resources at their command and the fact that Windows is a monoculture so their mistakes simultaneously affect millions of people. Most FOSS software is written by a "rag-tag band" by comparison, so why isn't Microsoft held to a higher standard of responsibility?
It is a miracle that curiosity survives formal education. - Einstein
"A critical vulnerability exists in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems" (emphasis added.)
TFA only mentions Windows because they don't bother scanning Macs or Linux boxes.
You know ...
I hate Adobe software.
There, I said it.
Photoshop is buggy. Premiere is often weird and arcane. Flash and Reader have had some NASTY security holes of late. Reader is a painfully source resource pig. Adobe is at least a year late in releasing a 64 bit version of Flash (outside of the Linux beta).
You know you're in trouble when freakin' MicroSoft is putting out better software.
Adobe's releasing one awful update after another. They seem to lack the resources and expertise to maintain a huge portfolio of overly-ambitious software on a wide variety of platforms. They just can't seem to get anything right with their free (as in beer) software from a security, and sometimes even usability, standpoint.
Dear god.
Request to Adobe: if you want to be the gateway for rich content on the 'net, please realize what's at stake if you fsck things up. By botching security, you're putting millions of people at risk for having their lives turned upside down by thieves and fraudsters. You're releasing the digital equivalent of Pintos. Please start fixing your mess.
as this problem was worked on some months ago.
It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".
The character of the author of NoScript is that of the authors of
1) adware (redirecting to his ad-laden website with each meaningless update and preventing you from blocking these ads)
2) spyware/malware (changing configuration without the user's consent).
An interesting approach, using IP addresses as version numbers
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
If it were an actual mistake, then I would agree with you. It wasn't an error.
He purposefully did it and when he got caught he then apologized for it. What I'm saying is, if nobody said anything, he'd still be doing it.
This is a hard thing to understand and you raise a very valid question. I hope to answer that without just dismissing it or pretending like it isn't important. I don't know the man personally and have to go by what he and others have written, so please consider this just my opinion as I cannot speak for him.
You are right that he deliberately coded the functionality that made unauthorized and underhanded modifications of another, unrelated add-on (ABP). The mistake or error was in believing that the ends justify the means, that there is ever a good reason to do such a thing. All improper actions he took were rooted in that one error. But not for that belief, he would have probably regarded the temptation as "what the hell, I can't do that." Sometimes people get lucky and they see what's wrong with such an error on their own, before anything has to blow up in their face. Other times they have to see for themselves why it's harmful, often by being harmed by it or harming others by it, before their regret at having spectacularly failed reveals the error of their ways. It's sort of like the religious idea of "forgive them because they know not what they do," though if you asked them what they were doing they could describe their behavior accurately -- this is not really a contradiction.
I'm not an impeccably perfect person either. I have had to learn some lessons the hard way and I suspect every other human being could say the same. So no, I don't share the willingness to condemn someone who has fully come clean and has turned away from what he was doing. I think doing that would say more about me than about him. If anything, I celebrate his courage and wish it were more common.
It is a miracle that curiosity survives formal education. - Einstein
WRONG on many levels. If you're not running as admin, only your user files will get affected in all the current OSes including XP. But IE8 on Windows 7/Vista does sandboxing and hence is more secure than Firefox on Ubuntu out of the box. Don't believe me? Read is straight from the horse's mouth. http://blogs.zdnet.com/security/?p=2941
Why Safari? Why didnâ(TM)t you go after IE or Safari?
Itâ(TM)s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs donâ(TM)t do. Hacking into Macs is so much easier. You donâ(TM)t have to jump through hoops and deal with all the anti-exploit mitigations youâ(TM)d find in Windows.
Itâ(TM)s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesnâ(TM)t have anti-exploit stuff built into it.
[ SEE: 10 questions for MacBook hacker Dino Dai Zovi ]
With my Safari exploit, I put the code into a process and I know exactly where itâ(TM)s going to be. Thereâ(TM)s no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I donâ(TM)t know where it is. Even if I get to the code, itâ(TM)s not executable. Those are two hurdles that Macs donâ(TM)t have.
Itâ(TM)s clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But thatâ(TM)s only half the equation. The other half is exploiting it. Thereâ(TM)s almost no hurdle to jump through on Mac OS X.
This space for rent.
It's not a "problem" that can be "worked on". It's the character of the author. As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".
That's a pretty dismal view of human nature. I, on the other hand, believe people can change.
--Bruce
There are 10 kinds of people in the world: those who understand binary, and those who don't.
As any decent psychologist will tell you that character is inborn and cannot be changed or "worked on".
If by "decent", you simply mean, "holds your archaic worldview", I suppose...
The notion that people's character is set in stone at birth is laughably absurd.
The character of the author of NoScript is that of the authors of
1) adware (redirecting to his ad-laden website with each meaningless update and preventing you from blocking these ads)
2) spyware/malware (changing configuration without the user's consent).
How about:
3) people who make mistakes.
The real "test of character" isn't whether he made a mistake, but what he does about it afterwards. So far, he seems to have responded appropriately, which shows good character, actually.
No decent psychologist I know of would ascribe personality (of which character is a part of) to inborn traits, disregarding experience and environment. Character as an inborn trait is an asinine idea: neither the behaviorist nor the biopsychologist would take that statement seriously.
A computer worm that spreads through Flash and PDFs on PCs without the latest security updates is posing a growing threat to users blitheringly stupid enough to still think Windows is not ridiculously and unfixably insecure by design.
1) This vulnerability exists on OSX, Windows, and Linux.
2) The annual pwn2own competition, among others, shows that Linux and Windows are similarly secure and OSX is much less secure. OSX goes down first every year, while Windows and Linux both last until later days of the competition when more direct access to the systems is granted to the contestants.
A Windows machine is more likely to be compromised, but that's because of market share. "Insecure by design" implies that you're talking about the security of the OS against someone who wants to compromise it. It's proven every year that only OSX lags in this area, and it lags quite badly (this year's winner rated the difficulty of compromising Vista and Linux as a 9-10, and the difficulty of breaking into OSX as a 3, IIRC).
3) Goto 1)
"I zero-index my hamsters" - Willtor (147206)