Slashdot Mirror
New Flash Vulnerability Being Exploited In the Wild (trendmicro.com)
An anonymous reader writes: Researchers from Trend Micro report a new attack on fully-patched versions of Adobe Flash. The attacks originate from an espionage campaign run by the group known as Pawn Storm, and seem to target only government agencies. "Ministries of Foreign Affairs have become a particular focus of interest for Pawn Storm recently. Aside from malware attacks, fake Outlook Web Access (OWA) servers were also set up for various ministries. These are used for simple, but extremely effective, credential phishing attacks. One Ministry of Foreign Affairs got its DNS settings for incoming mail compromised. This means that Pawn Storm has been intercepting incoming e-mail to this organization for an extended period of time in 2015."
Really? What would be news here is if Flash DIDN'T have a vulnerability for a change...
I uninstalled Flash on my computers, and the world did not end.
https://www.youtube.com/c/BrendaEM
..........another excellent reason to use AdBlock and NoScript.
Flash not allowed to run? No Flash exploit, simple as that.
Just cruising through this digital world at 33 1/3 rpm...
No problem, I'll just put my gov't work on a home server.
Table-ized A.I.
It seems to me that Adobe Systems is no longer a well-managed company, and hasn't been since Bruce Chizen got tired of managing Adobe, which was well before he resigned in 2007. Here is a story from 2007 about that: Bruce Chizen's legacy.
This is a comment from a reader of that story who called himself Tidewind: "I might be in the minority on this, but under Bruce Chizen, I felt Adobe became, well, arrogant." That was my experience, also.
Part of the attraction of Flash has been that it is used to violate the privacy provisions of browsers. Flash can be used to generate what are called Flash-cookies, Local Shared Objects (LSOs), or Super-Cookies, which are files placed on a visitor's computer by the Flash plug-in.
(To avoid permanent tracking: In Firefox, use the BetterPrivacy add-on.)
Now Adobe is trying to make money by making its very expensive products even more expensive by charging monthly for them.
Microsoft followed that monthly business model with Office 365: Pay every day, 365 days each year, even if some of those days you don't have internet access. (Read the comments about Microsoft's other methods of abuse, such as restricting each copy to one country.)
Flash is either VERY buggy, or deliberately buggy. Possibly one way Adobe Systems makes money is by allowing vulnerabilities supplied by secret government agencies. Those agencies can spend billions of dollars of taxpayer money without public oversight.
The new software company business model is apparently "Be abusive".
I would like to see someone with some resources dump something towards creating a nice open source replacement for Flash that doesn't have all the security holes and problems of the Adobe product.
Of course the real problem is all the content sites out there that (for some idiotic reason) are relying on Flash for DRM and which cant be made to work on any flash alternative due to the US DMCA and other similar laws around the world.
I would like to see someone with some resources dump the source code of all Adobe products, that would be an interesting read!
Adobe software has been bugware for as long as I remember. Adobe Premiere was the software that taught me to hit CTRL+S every few seconds, and save a backup copy every half hour.
'Crap, Premiere just crashed again.'
'Double crap. It corrupted my save file just before it crashed.'
*sigh* I would really think those agencies would have people who are sufficiently paranoid as to not allow Flash on those computers. Or are government officials all demanding they be able to watch YouTube videos?
Flash has been a gaping series of security holes for almost 20 years now, why the hell do people keep trusting it?
Lost at C:>. Found at C.
Considering how much you say MOOOO, perhaps it's you that is the cow.
I don't trust atoms -- they make up stuff.
Flash: A reeking bottomless pit of zero-day vulnerabilities, all different.
It seems to me that Adobe Systems is no longer a well-managed company, and hasn't been since Bruce Chizen got tired of managing Adobe, which was well before he resigned in 2007.
"no longer"??? Adobe Reader was one of the biggest attack vectors that has ever existed in the history of the web, going back way before 2007. I kid you not, a new exploit came out month after month after month. It was ridiculous. Adobe Flash is actually slightly better in that regard, if that tells you anything.
Better known as 318230.
See subject: HOWEVER, we haven't seen all the "ins-&-outs" of that yet either - give it time! Bet it shows glaring vulnerabilities too (despite the state of modern computer science being what it is, one HELL of a LOT better than it was when I started it in 1981 but, men made it - men, screwup!).
Sad truth coming from experience over decades in the art & science of computing here on that above. We're not 100% guaranteed solid in LOTS of things out there now.
On HTML5 - I've tried it in IE11 "latest/greatest patched" etc. - et al, it plays ok - as good as Flash - & I'd wager it's had time & early base design vs. issues that plague flash till it's ultimate dying day... most likely. We tend to learn from our mistakes & build better, next time.
(Only thing I really *REALLY* wonder about HTML5 is, is IF "the infamous they" using it for 'nefarious' purposes, ala tracking & what-not/what have you...)
APK
P.S.=> Honestly? I thought they'd have ALL of Windows "bugs/security issues" gone by 2013-2014 outside @ the latest... hasn't happened yet - same point as above... apk
I already have a russian bride. Thanks though.
Really? By definition, a zero-day exploit would affect fully patched versions of anything. Duh! If they had time to patch it to fix the exploit, it wouldn't be zero-day any more, would it!
Does anything but ads actually use Flash in this day and age? I haven't had it installed for several years!
Let's see... these are just some results using Firefox 41.0.1 on OS X Mavericks:
Spotify: "To enjoy Spotify, please install Adobe Flash. It's free."
Pandora: "In order to use Pandora internet radio, please upgrade to a more current browser or install a newer version of Flash (v.10 or later)."
Hulu: "Hulu requires Flash Player 11.0.1.152 or higher. Please download and install the latest version of Flash Player before continuing."
I'm sure there are plenty more, but just these three are enough to prove that you're dead wrong -- or just trolling. And no, there's no love lost between Flash and me, either.
RT.
Even though I don't use those services, I just tried your links. Spotify works and Pandora works as well (Music plays fine). Hulu is the only one that does not work without flash.
I am surprised...not that there's another Flash exploit, but that people still use flash.
"Based on our analysis, the Flash zero-day affects at least Adobe Flash Player versions 19.0.0.185 and 19.0.0.207."
Does this Flash Zero-Day work on OS or Linux?
Given that Adobe, while being the major vector of insecurity on the web, has never even been lashed with a wet noodle by the Feds, one can only conclude they are given cover for exactly this.
It's almost as funny as the US public still believing their elected officials are actually in control of the organs of state security (thems wit everbodys skeletons).
Even though I don't use those services, I just tried your links. Spotify works and Pandora works as well (Music plays fine). Hulu is the only one that does not work without flash.
Interesting... what browser/OS combination? The latest Safari complains in exactly the same way.
RT.
Have fun maintaining that host file you idiot. Routers beat hosts file, so your whole deal falls apart because your network stack still gets involved with hosts. Blocking this stuff on the router means it never even gets on your network, no wasted cycles. But again, this means you will spend the rest of your life maintaining this growing hosts file or block list, when adblock and other browser plugins do this, and update it, for you. That said, since adblock has been sold and no one will say to whom, and this nonsense of "Acceptable ads", I wouldn't recommend using and trusting it for much longer. But I'd still suggest that over whatever crap you are spamming on each and every thread even remotely close to this subject. Gee... I wonder if you might be on the payroll for this "application" that requires administrator permissions to merely update your host file. No thanks.
Yup, having to continually spam your questionable software makes it less questionable. Said no one, ever.
What has a pink/red color got to do with the application, anyhow? Perhaps you meant 'rogue?' I don't know if it is always you but this seems to be a common one for ACs. Well, I finally got bored enough to point it out. While maybe not you, 'alot' is not a word and there's a difference between fewer and less.
"So long and thanks for all the fish."
Unless you play games, or need DRM content, you might be okay.
https://www.youtube.com/c/BrendaEM
Don't mention Nethack. Or Zork. I'm not even sure if half the people who play Fallout actually played the first two. I stopped gaming around the time of my enjoyment of the Fallout 2 game. It was awesome. I've not really gamed since but I remember (and played) Rogue. Or, ahem... Rouge... *sighs* Yes, yes I played the French word for Red. I dunno what people do with their spare time but it doesn't appear to be learning new things or improving themselves. I'm glad I'm not a people.
"So long and thanks for all the fish."