Adobe Flash To Be Top Hacker Target In 2010

An anonymous reader writes "Adobe Systems' Flash and Acrobat Reader products will become the preferred targets for criminal hackers (PDF) in 2010, surpassing Microsoft Office applications, a security vendor predicted this week. 'Cybercriminals have long picked on Microsoft products due to their popularity. In 2010, we anticipate Adobe software, especially Acrobat Reader and Flash, will take the top spot,' security vendor McAfee said in its '2010 Threat Predictions' report. 'We have absolutely seen an increase in the number of attacks, around Reader in particular and also Flash Player to some extent,' CTO Kevin Lynch told reporters at the Adobe Max conference in October. 'We're working to decrease the amount of time between when we know about a problem and when we release a fix. That used to be a couple of months; now it's within two weeks for critical issues.'"

Comments

I already see this happening

[BadAnalogyGuy]

Sometimes when I go to a website, it will have Flash malware which forces me to download unwanted content and then plays it without my consent.

Damn you Youtube!!!

Re:I already see this happening

[VanessaE]

Tubestop is your friend (tm).

Re:I already see this happening

[digitalunity]

Does anyone else see the irony that the white paper is in Adobe PDF format and most people will be reading about Adobe Reader vulnerabilities IN Adobe Reader?

Yuh huh

[Anonymous Coward]

Let me guess, Microsoft are just ready to offer the solution in the form of Silverlight, right?

Re:Yuh huh

[Anonymous Coward]

Microsoft would be foolish to let pass an opportunity to promote its competing products, yeah. They tend not to be foolish when it comes to such things.

I don't see what Adobe's problem is with the security vulnerabilities. Don't trust data from the network, and don't ever use a variable/etc without bounds checking. How many versions, bugfixes, patches, and revisions does it take to get these two basic things right? Real question. I don't understand the difficulty here.

Re:Yuh huh

[El Lobo]

That would be the right time, yes. But actually, the problem with todays systems is not as much the OS as the applications that run on it. Almost every self-respecting OS has an Auto-update function that works more or less well. Unless you are a paranoid schizophrenic that update the OS manually (forgetting to do it now and then), the OS is relatively secure. The problem are the applications. Now tell me, how many of us run to download a new Java machine or a new Acrobat reader, or a new Cobian Backup, or a new WinAmp when a vulnerability is discovered on any of those products. Hell you will be lucky if you even get to know that a new vulnerability was found on your faithful uTorrent... So when you get pwned, what's the first thing the user blame? The OS of course...

At work we had a Windows Server 2008 hacked. It was killing the whole network sending spam and trying to infect other machines on our AD. Our boss was already blaming Bill Gate's mother ... On a closer inspection, the problem was discovered. The system was running a quite old version of WebBoard (a system for collaboration, which was developed originally by O'Reilly). The firewall has the port 8080 open to allow users to connect. Some people discovered the open port, found out that WebBoard was running, and took advantage of the vulnerability to upload and run malicious code on the server. Because WebBoard is a service, running as the System account, you can imagine what happened there. Did our IT manager know about this vulnerability. Not at all, even if it was fixed on a posterior build.... How many "forgotten" programs, and non-OS related services do people have running in their machines, unpatched and unattended? Think about this...

Re:Yuh huh

[causality]

That would be the right time, yes. But actually, the problem with todays systems is not as much the OS as the applications that run on it. Almost every self-respecting OS has an Auto-update function that works more or less well. Unless you are a paranoid schizophrenic that update the OS manually (forgetting to do it now and then), the OS is relatively secure. The problem are the applications. Now tell me, how many of us run to download a new Java machine or a new Acrobat reader, or a new Cobian Backup, or a new WinAmp when a vulnerability is discovered on any of those products. Hell you will be lucky if you even get to know that a new vulnerability was found on your faithful uTorrent... So when you get pwned, what's the first thing the user blame? The OS of course...

At work we had a Windows Server 2008 hacked. It was killing the whole network sending spam and trying to infect other machines on our AD. Our boss was already blaming Bill Gate's mother ... On a closer inspection, the problem was discovered. The system was running a quite old version of WebBoard (a system for collaboration, which was developed originally by O'Reilly). The firewall has the port 8080 open to allow users to connect. Some people discovered the open port, found out that WebBoard was running, and took advantage of the vulnerability to upload and run malicious code on the server. Because WebBoard is a service, running as the System account, you can imagine what happened there. Did our IT manager know about this vulnerability. Not at all, even if it was fixed on a posterior build.... How many "forgotten" programs, and non-OS related services do people have running in their machines, unpatched and unattended? Think about this...

Perhaps the OS deserves some blame (kneejerk types, note that some != all). On Windows there is no equivalent to the various centralized package managers that come with standard Linux distributions. You cannot go to one place and run one program and simultaneously update every last application installed. The biggest obstacle seems to be the copyright restrictions that prevent the redistribution of most Windows software. But for whatever reason, on Windows, every last application is on its own and must make provisions for its own updates. If it doesn't, or if the user gets tired of dialogs popping up and just wants to get rid of them, then you get the scenario you describe. On a Linux or BSD -style system, WebBoard would be a package like any other and would be regularly updated as part of your routine system maintainence.

Re:Yuh huh

[GameboyRMH]

I can't wait until HTML5 replaces them both.

Re:Yuh huh

[KiloByte]

You see, somehow this isn't an issue on other OSes. Why? Because there's an unified update mechanism that can be used by any program.

In addition, most of available software is packaged in a big repository with security support, and if you use third-party repositories, they can use the mechanism as well. On Windows, though, every program has to implement its own update -- some do, like Firefox, Thunderbird, WinAmp or Java, but the vast majority lacks it. And even those few with an auto-update function have it in an inconsistent matter, requiring user intervention as well.

So your boss was right, Bill Gates' mother does have some guilt for the intrusion into your server.

This is about finding a common infection point

[fprintf]

With the recent popularity of Apple products and other internet surfing enabled devices, this is all about infecting the most machines possible. Previously that was easily accomplished by targeting the most popular devices - Windows PCs. But now there are even more targets available and most of them run Adobe Reader and Flash.

What happens to all the folks (us?) who have been gloating over the security of our Macs, Linux, smartphones etc. when these apps get broken? Time to eat crow?

Re:This is about finding a common infection point

[El Capitaine]

No, what will happen is that the Macs, Linux, smartphones, etc. will still be praised as incredibly secure, and it will just be Adobe's fault. Nobody likes to take the blame or admit that their favorite platform isn't what they said it was, but everyone loves to insult Flash.

Re:This is about finding a common infection point

[causality]

What happens to all the folks (us?) who have been gloating over the security of our Macs, Linux, smartphones etc. when these apps get broken? Time to eat crow?

I would imagine that if Flash etc. became poor enough in terms of security we'd see more attention on projects like Gnash.

No joke. Even if they are absolutely equally secure, Gnash provides source code. You can build that source with SSP (or equivalent). You can also build it as PIC and apply many other restrictions with a PaX and/or Grsecurity kernel. All of these will reduce the chances that a known vulnerability will lead to a successful exploit. Specifically, a known vulnerability that would normally allow an attacker to run arbitrary code stands a good chance of merely crashing the application.

You just don't have options like this with binary blobs. I really would like to see more development of Gnash, as it seems that Adobe Flash is on a downhill course in terms of security and will continue to be a problem. Source code is about freedom and control. With such control, you can take steps to manage a risk even if you cannot perfectly mitigate it.

Re:This is about finding a common infection point

[Paradigm_Complex]

What happens to all the folks (us?) who have been gloating over the security of our Macs, Linux, smartphones etc. when these apps get broken? Time to eat crow?

I can't speak for Macs or smartphones (who gloats over the security of smartphones? Things like the amount of iphone jailbreaking going on or the Tmobile sidekick crash make it pretty clear smartphones have issues...), but Linux is still more secure the Windows in this respect. There's numerous ways to isolate the damage that could be done from a hole in flash. MAC like SELinux or AppArmor are perfect for this, and Windows still doesn't have a competent MAC implementation (MIC is insufficient). There's ways to sandbox firefox without MAC, too, such as setting everything up to sudo to another user every time firefox is called. There's a LOT of ways to deal with this.

Now, all of these take some work on the user's part. Stupid/lazy Windows users can be pwned just as badly as stupid/lazy Linux people. But it's not as though a competent individual is just as badly off on both platforms... Linux has solutions for dealing with untrusted things like flash where Windows does not. If you actually and actively care about security, you can continue to gloat about Linux's superiority in this respect. If you're too lazy to take security seriously, you can be pwned on both counts.

Re:This is about finding a common infection point

[CodeBuster]

There are other issues which make security more than simply a technical problem in commercial closed source products like Flash. Sometimes a bug is not fixed because management feels that "nobody cares" or "users won't notice" and so they order the devs to ignore it to "cut costs" and "save money". At other times, security is thought (by managers) to make the product "user unfriendly" or "too hard" to use. I have heard of projects where the devs were deliberately ordered to remove security features because they weren't "easy to use". This is one area where open source projects like Linux consistently do better (i.e. quality and security) whereas closed source products tend to get the chrome and polish done, but fail the quality and security tests. Some rare companies, Apple being the canonical example, do both well but then it sure doesn't come cheap.

WTF

[tylersoze]

Could someone please explain to me why I have to be worried about $#! document viewer compromising my system? WTF Adobe!? Glad I don't have to use it to read PDF's anymore. Thank you OS X for builtin support.

Re:WTF

[Abcd1234]

Don't be silly, buffer overflows can happen anywhere. Hell, IE has been compromised thanks to a b0rked JPEG decoder in GDI+, ffs.

That said, Adobe has certainly made their job harder by including a full-blown ECMAScript engine in acroread. But even without that, the ubiquity of Flash and Reader makes them ideal targets for hackers, thus further illustrating why software monoculture is a bad thing.

Acrobat and Flash

[Enderandrew]

Acrobat and Flash vulnerabilities were two of the biggest issues I saw in 2009, even more than Office vulnerabilities.

For one, Office only seems to hit the enterprise sector, and most enterprise users have at least some security. Office is more likely to be patched by users, and there were fewer vulnerabilities.

Most users don't have the latest version of Acrobat or Flash. They effect home and enterprise users.

Even more alarming, it seems that Flash vulnerabilities are one of the biggest weaknesses on Mac and Linux, where security is an after-thought.

For Windows users, I often recommend they swap Acrobat with a free reader like Sumo or Foxit, which is smaller, faster, and has less vulnerabilities. Sadly, there aren't many GOOD Flash alternatives.

I really hope HTML 5 phases out the popularity of Flash.

Re:Quick fixes won't be enough.

[dgatwood]

Even if they updated regularly, it would still be an easy target. Something like six of the top ten browser crasher bugs are in Flash plug-ins. There are so many crasher bugs that nobody can even keep count. When you realize that every single one of those is probably an exploitable attack vector, you quickly understand why I use click2flash. Swiss cheese belongs on sandwiches, not on the public Internet....

Oh, the irony!

[Locke2005]

"We predict that Acrobat Reader will be the top hacker target in 2010, and that is why we are distributing our report in a format that can only be viewed by using Acrobat Reader!"

Re:Do the hacks exploit buffer overflow issues?

[psydeshow]

The hacks in Flash are often social engineering tricks to get at files, camera, microphone... though I think the most growth will be enabled by the excellent support for socket communication in today's actionscript. In other words, good old-fashioned cross-site-scripting.

There is already a solution

[jrozzi]

Developers can stop using flash and end-users should uninstall it. There is already a solution out there and it is called javascript. 90% of the things you can do in flash can easily be done using javascript, jquery, or some other javascript framework. For the remaining 10%, HTML 5 will be able to handle most of it (canvas tag, videos, better form support, etc), and the remainder of things that javascript/html can't do that flash can do (if there is anything), is not even worth implementing in a website. Since javascript and HTML is all open and much easier to work with, I foresee flash and silverlight on the decline. This especially holds true when HTML 5 is fully supported in most people's browsers.

Re:There is already a solution

[99BottlesOfBeerInMyF]

There is already a solution out there and it is called javascript. 90% of the things you can do in flash can easily be done using javascript, jquery, or some other javascript framework.

The problem with your statement is you assume the Flash content creators are programmers with enough free time. In reality, many of them have degrees in communications or visual arts or are just programmers who want a quick and easy tool for throwing together some quick video/UI content for the Web. From what I've seen, the decently made tools to create such content are mostly created by Adobe and focused on Flash. Unless a company steps up and creates equivalent tools for HTML5 and javascript and those tools gain a significant market share and momentum and ecosystem, I see Flash remaining dominant, with MS gobbling up a smaller share.

If Adobe doesn't do cleanup, God help us

[Ilgaz]

Besides couple of security issues which are only fixed by disabling javascript in Adobe Reader EXISTS today, scheduled to be fixed in 15 days, here are 2 examples of the culture who actually develops/packages the OS X version.

First, this is what you will see in your system.log, whatever browser you use:
[0x0-0x1f01f].com.operasoftware.Opera[157]: Debugger() was called

This is the current flash, released just weeks ago. This is a packaging issue which nobody than a complete newbie would do. They forgot the damn debugger symbol in final binary they ship to millions. I also heard if you are a unlucky developer who has XCode open at the time when you go to a site featuring Flash, that "call" may actually break your own application's tests or running "from there". Amazingly stupid eh? This has been reported to Adobe by many people, users like me, Developers getting hit, Browser vendors/developers (guess who users contact&blame when they see browser name?) and they keep that debug symbol, even ignoring the latest chance to get rid of it weeks ago.

Want to see more? Here is a bug reported for ages, years, since early OS X days. Disk permissions broken while installing Flash. This is some amazing thing which even Apple is constantly bugged about and one of the perfectly valid excuses of "permission repairer" people on OS X land. Of course, as Apple really secured the permission repair process meaning hundreds of thousands of files will be validated before "repair", it also means 20 mins of a insanely system loading process even on highest end machine. I actually had access to a opto xeon (8x xeon) machine with 16 GB of RAM and just fired up "repair permissions" just to see if it is effected by CPU/RAM specs. No, still 13 mins.

No need to paste 10s of lines mentioning very stupidly wrongly set permissions. Note that it is also Apple to blame a little, perhaps Adobe could care if they had a bug report coming from @apple.com having thousands of user feedback attached. If I know Apple enough, they must have reported it to Adobe several times since their bug reporter department even finds shareware vendors from web once they spot that their application causes the issue. So, chances are high that these pathetic idiots also ignores Apple Inc. themselves reporting issues, no matter how trivial they are.

So, Adobe needs to do debugger symbol, permissions cleanups or they must get rid of the idiots who forgets a debugger symbol in a final product used by millions and can continue living their lives as nothing happened.

PS: Intego, Symantec... Do you read these stories? MCafee, do you read your own white papers? Is the code which will check the swf files on the fly up and running? Or are you still developing sigs for imaginary threats and impossible to run Word macros? Don't blame people when they call you snake oil seller if it is the case.

Good luck with million hour video downgrades

[Ilgaz]

Unless you drug the IT departments of major media sites to go back to 1990s while H264 exists and H265 is being mentioned, HTML5 can't replace Flash.

It is the codec, the stupid fanaticism about "open codecs" to a degree of inviting Apple to jump to VP3 while they spent billions for H264 and the damn MP4 is being lite version of their OWN container, Mov.

For terabyte/petabyte sized media outlets, changing the codec means millions of real World money, not some "everything should be open" dreamer's money. In real World media, you even keep U-Matic players from 1970s maintained since in one occasion, you may need that archive tape from 1970s which haven't been digitized since it is part of your millions of hours archive which may be rarely (once a month) used.

HTML5 designers should really visit a major TV studio to see how things are really done, why you must do some insanely great progress to convince the people to switch, how TV and Video guys doesn't give a heck to "patent" problem as long as multiple vendors/documented standards/EBU etc. approvals exist.

Re:Quick fixes won't be enough.

[Jeng]

You might update, but "people" are stupid and do not.
"People" tend to minimize or close anything that pops up in between start up and opening the app that one started the computer to use. Whether it be windows update, virus scan update, or updates of nagging software. Of those three the updates of nagging software will be the most likely to just be closed without any update taking place.

Re:Silverlight couldn't be a Flash rival,thanks to

[McBeer]

their V2 dropped support for PowerPC macs which several people

So Silverlight can't possibly compete with flash because it doesn't support a hardware platform that hasn't been produced in 5 years now and already has negligible market share?

In Silverlight V3, things getting even more complex as the Win32/64 Silverlight V3 has more features than OS X 32/64 one

The only differences I'm aware of between mac and windows silverlight 3 are quite trivial

While mentioned, where is the iPhone/Symbian and even Windows Mobile support?

In the works . Admittedly, MSFT is dissapointingly behind schedule on this front.

Some of your complaints with Silverlight have merit. It isn't perfect yet, but it has made remarkable progress in the 2 years it has been out and most certailnly is a rival to flash. Flash had an 11 year head start and Silverlight already does just about everything it does and a few things better. Silverlight lags behind flash in market penetration and platform support, but at the rate it is going, it will catch up quite soon.