Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Flash Vulnerability Being Exploited In the Wild (trendmicro.com)

Posted by Soulskill on from the it-must-be-tuesday dept.

An anonymous reader writes: Researchers from Trend Micro report a new attack on fully-patched versions of Adobe Flash. The attacks originate from an espionage campaign run by the group known as Pawn Storm, and seem to target only government agencies. "Ministries of Foreign Affairs have become a particular focus of interest for Pawn Storm recently. Aside from malware attacks, fake Outlook Web Access (OWA) servers were also set up for various ministries. These are used for simple, but extremely effective, credential phishing attacks. One Ministry of Foreign Affairs got its DNS settings for incoming mail compromised. This means that Pawn Storm has been intercepting incoming e-mail to this organization for an extended period of time in 2015."

10 of 101 comments (clear)

  1. Surprise? by Anonymous Coward · · Score: 5, Funny

    Really? What would be news here is if Flash DIDN'T have a vulnerability for a change...

    1. Re:Surprise? by Lunix+Nutcase · · Score: 2

      If the day ends in 'Y' there's likely to be a Flash exploit in the wild.

  2. Uninstall it. by BrendaEM · · Score: 3, Interesting

    I uninstalled Flash on my computers, and the world did not end.

    --
    https://www.youtube.com/c/BrendaEM
    1. Re: Uninstall it. by Lunix+Nutcase · · Score: 3, Informative

      http://kb.vmware.com/selfservi...

    2. Re:Uninstall it. by FrozenGeek · · Score: 2

      Having worked for a government agency, let me just say that the level of computer savvy, not even to mention the level of computer security savvy, in government is appalling. People who know better have to work very hard to keep their heads from exploding at the stuff that goes on in government. It is worse than in private industry because the likelihood of being fired is so low.

      --
      linquendum tondere
  3. And here we go....... by JustAnotherOldGuy · · Score: 5, Insightful

    ..........another excellent reason to use AdBlock and NoScript.

    Flash not allowed to run? No Flash exploit, simple as that.

    --
    Just cruising through this digital world at 33 1/3 rpm...
    1. Re:And here we go....... by JustAnotherOldGuy · · Score: 2

      You mean another reason to not use Flash?

      AdBlock... nothing to do with Flash. This is for blocking ads. While some ads are built in Flash, most are images or text or HTML5 based.

      I'd say that ~50% of all the ads I see (well, used to see, lol) were Flash. And sadly, Flash is still used all over the place, especially on older sites.

      So for me, blocking Flash is a no-brainer.

      As for NoScript, it blocks a lot of the javascript that's often used to launch the ads you see on sites, including the ads that use Flash.

      If you've ever run ads from Advertising.com, Doubleclick, FastClick, etc etc, they're almost always pulled from the ad company's servers by a snippet of javascript that you paste into the page (or into your ad rotator). Blocking javascript knocks that shit out, period.

      NoScript and AdBlock are indispensable for me, together they're a one-two punch that knocks out most of the stuff I'd normally have to worry about.

      --
      Just cruising through this digital world at 33 1/3 rpm...
  4. Solved by Tablizer · · Score: 5, Funny

    seem to target only government agencies

    No problem, I'll just put my gov't work on a home server.

    --
    Table-ized A.I.
  5. Flash is either VERY buggy, or deliberately buggy. by Futurepower(R) · · Score: 3, Insightful

    It seems to me that Adobe Systems is no longer a well-managed company, and hasn't been since Bruce Chizen got tired of managing Adobe, which was well before he resigned in 2007. Here is a story from 2007 about that: Bruce Chizen's legacy.

    This is a comment from a reader of that story who called himself Tidewind: "I might be in the minority on this, but under Bruce Chizen, I felt Adobe became, well, arrogant." That was my experience, also.

    Part of the attraction of Flash has been that it is used to violate the privacy provisions of browsers. Flash can be used to generate what are called Flash-cookies, Local Shared Objects (LSOs), or Super-Cookies, which are files placed on a visitor's computer by the Flash plug-in.

    (To avoid permanent tracking: In Firefox, use the BetterPrivacy add-on.)

    Now Adobe is trying to make money by making its very expensive products even more expensive by charging monthly for them.

    Microsoft followed that monthly business model with Office 365: Pay every day, 365 days each year, even if some of those days you don't have internet access. (Read the comments about Microsoft's other methods of abuse, such as restricting each copy to one country.)

    Flash is either VERY buggy, or deliberately buggy. Possibly one way Adobe Systems makes money is by allowing vulnerabilities supplied by secret government agencies. Those agencies can spend billions of dollars of taxpayer money without public oversight.

    The new software company business model is apparently "Be abusive".

  6. Re:Flash? by ReeceTarbert · · Score: 2

    Does anything but ads actually use Flash in this day and age? I haven't had it installed for several years!

    Let's see... these are just some results using Firefox 41.0.1 on OS X Mavericks:

    Spotify: "To enjoy Spotify, please install Adobe Flash. It's free."

    Pandora: "In order to use Pandora internet radio, please upgrade to a more current browser or install a newer version of Flash (v.10 or later)."

    Hulu: "Hulu requires Flash Player 11.0.1.152 or higher. Please download and install the latest version of Flash Player before continuing."

    I'm sure there are plenty more, but just these three are enough to prove that you're dead wrong -- or just trolling. And no, there's no love lost between Flash and me, either.

    RT.