Slashdot Mirror
Emergency Adobe Flash Patch Fixes Zero-Day Under Attack
msm1267 writes: Adobe has released an emergency patch for a Flash zero-day used in targeted attacks by APT3, the same group behind 2014's Clandestine Fox attacks. Adobe said Flash Player 18.0.0.161 and earlier for Windows and Macintosh systems are affected, as is 11.2.202.466 for Linux 11.x versions.
The current iteration of Clandestine Fox attacks shares many traits with last year's attacks, including generic, almost spam-like phishing emails intent on snaring as many victims as possible that can be analyzed for their value before additional attacks are carried out. The two campaigns also share the same custom backdoor called SHOTPUT, as well as an insistence on using a throwaway command and control infrastructure.
The current iteration of Clandestine Fox attacks shares many traits with last year's attacks, including generic, almost spam-like phishing emails intent on snaring as many victims as possible that can be analyzed for their value before additional attacks are carried out. The two campaigns also share the same custom backdoor called SHOTPUT, as well as an insistence on using a throwaway command and control infrastructure.
i said it before and i'll say it again.
there are very few reasons to keep flash installed/enabled. if you must have it, use flashblock but chances are you can just disable/remove it completely. if some site still uses flash to play video, leave a complaint in the comments. those that haven't switched to html5 yet will do so soon enough.
if you still have java plugin installed, you better have a good reason because no (sane) sites use that shit.
Anons need not reply. Questions end with a question mark.
Youtube uses HTML5 now. Why does anyone still have a reason to use flash? (I mean besides for watching pr0n, which you do inside a virtual machine, and you restore to a checkpoint afterwards to completely avoid any possibility of malware infestation or cross-session cookies, right?)
tl;dr: Uninstall flash. You don't need it anymore.
I have de-installed the "Flash" malware some time ago and it will _not_ find its way on my computer again. This thing is a solution for nothing, but a persistent problem. It really is a pity, Adobe used to make good software. Not anymore.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The issue is that Flash's functionality hasn't changed in years, but it needs a security update every other week. You'd think that Adobe could've have sorted that all out by now. If this is the quality of a simple playback plug-in, what conclusion can be drawn about the quality of the rest of their software.
Adobe Acrobat Reader v5 was about 15MB in total size after installation.
Adobe Acrobat Reader v11 is over 400MB in total size after installation.
I really don't think there's any question as to the quality of their shitty bloatware.
In fact, one could argue the main functionality that Adobe has brought to the desktop and browser in the last 10 years is plenty of attack vectors.
And all this bloatware bundling bullshit won't go away until we start holding vendors accountable for the vulnerabilities they create.
Oh it gets better. Since the last release, they now force mcafee on you.
Om, nomnomnom...