Slashdot Mirror
Adobe Hopes Pop-up Warnings Will Stop Office-Borne Flash Attacks
tsamsoniw writes "In the wake of the most recent zero-day attacks exploiting Flash Player, Adobe claims that it's worked hard to make Player secure — and that most SWF exploits stem from users opening infected Office docs attached to emails. The company has a solution, though: A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat."
This is why your data should not be executable.
I want to delete my account but Slashdot doesn't allow it.
Yeah!. Since the average user totally understands the situation, that "vague warnings of a potential threat" will, obviously, solve the problem. Pure genius.
"So what's wrong with it?"
"You have the latest flash virus. Have you opened any Word documents lately?"
"Of course! I use Word all day."
(scans hdd, finds the one in email that started it)
"Did you open this?"
"Of course I did. It's the weekly report."
"Didn't it WARN you there may be a virus?"
"Yes it opened up a box I hadn't seen before. But I needed to see the report, so I clicked the Open Anyway button."
"Didn't you get the memo last week about not clicking Open Anyway?"
"Of course I read the memo. But I need to read that report. I had to open it."
aaaand this is why this doesn't work anywhere near as well as Adobe says it will. No matter how many times you tell them to call you and NOT open it anyway, they still will. And you'll be at her desk again. Maybe later today even. Because she opened it anyway, because she "had to". (speaking from experience here)
The only reasonably effective way to implement this is with a policy that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)
I work for the Department of Redundancy Department.
There's absolutely no reason to have Flash installed on machines in an office. Remove it and give the users regular accounts so it can't be re-installed, and you'll be fine.
Except of course, for the web-based trainings that employees have to take that rely on Flash.
"This document contains macros which may harm your computer. Do you wish to allow them to run?" (Clicks "Yes" blindly.)
Some (or maybe all...IDK) Word documents that were actually templates contained macros in the absence of an actual wizard. This meant that in versions of Office that recognized the security hazard, you got a pop-up before the document actually opened. I personally clicked "Yes" or "Open Anyway" or "Allow" or whatever it said without even bothering to read it because I usually got the document from a trusted source (as in someone I trust, not someone a company/corporation trusts using an actual whitelist/blacklist). I presume many got tired of seeing the message as I did, and they did the same thing. Similar events will probably happen with this Flash issue. Your aunt sent you an e-card for your birthday from her virus-infested computer? Sweet! Allowed!
And before people ask, yes I was speaking in the past tense. I no longer use Microsoft Office, in favor of Google Drive's Office-like features that started out as "Google Docs & Spreadsheets". It may not be as full-featured, but I don't need it to be either.
I have been a captive in America my entire life. Everybody and everything uses customary units instead of metric.
Genuinely interested... what would you use Flash for in an office? Not counting people who develop Flash games for work, since they ought to be clueful enough not to get pwned.
At least in the medical field, every damned 'training' company, every manufacturer, every news site uses Flash. And uses it poorly. But it's not going away any time soon.
Faster! Faster! Faster would be better!
Meanwhile Gnash supports Youtube just fine, which remains Flash's sole legitimate use.
It even supports audio out of the box.
All rites reversed 2010
welcome to corporate america, you are responsible for shit you have no way to control or to fix.
just like everyone else.
those people who have to open those reports are in the same boat as you. if they dont open the report, then xyz doesnt get done, then a shit storm rolls down the hill and destroys the entire department.
Except of course, for the web-based trainings that employees have to take that rely on Flash.
Web-based training is a virus. It both decreases productivity and makes users unhappy.
No arguments here, but tell that to the state of California that requires 2 hours of sexual harassment training for all workers that supervise other employees. The training itself decreases productivity and makes users unhappy, making it web based doesn't make it moreso. A least I can browse the web while clicking through the tedious training with "quizes" with answers that anyone with a modicum of common sense can answer.
After 18 years or so of increasingly frequent popup messages appearing in popular software you would think everyone realises by now how useless they are. Normal users don't read popups, and those who do read them don't know or care what they mean, and/or they just choose to ignore them. Actually I think software vendors know exactly how useless they are, and in the case of security-related popups it's just the vendor saying "security is the end user's problem, not ours". Kinda like the warnings you get on cigarette packets.
Sorry.
It doesn't happen that way.
It just doesn't.
They tried this with browsers. It was egregiously cumbersome and conditioned people to auto-click YES to everything.
They tried this with Windows. It's still egregiously cumbersome and is still just conditioning people to blindly auto-click YES to everything.
So...NOW...they're adding MORE crap to click YES automatically to?
Third time's the charm?
FUCK NO!
Three strikes and you're out fuckers!
Warning popups prevent a small amount of infestations up front.
HOWEVER, down the road, as people get conditioned to the popups, they just click past without looking. Because the popups ARE IN THEIR WAY.
Adding a stupid popup is basically an admission that they're too goddamn stupid or lazy (or both) to secure their software properly. Or that their software is, inherently not secure or not able to BE secured.
At which point, it's crap that needs to be replaced with a better solution. Even if it means giving up the convenience of "Well this works right now".
Chas - The one, the only.
THANK GOD!!!