Slashdot Mirror
Adobe Patches Flash Zero-Day Exploited By Magnitude Exploit Kit (securityweek.com)
wiredmikey writes: Adobe released a Flash Player update on Thursday night to patch a zero-day vulnerability that has been leveraged by cybercriminals to deliver malware via the Magnitude exploit kit. The vulnerability [CVE-2016-1019], a memory corruption that can be exploited for remote code execution, was discovered after, on April 2, security researcher Kafeine of Proofpoint noticed a change in the Magnitude exploit kit. The sample was then investigated by FireEye, which determined that Magnitude EK had been exploiting a previously unknown vulnerability in Flash Player."Despite the fact that this new exploit could potentially work on any version of Adobe Flash, including a fully patched instance of Flash, the threat actors implemented it in a manner that only targeted older versions of Flash. In other words, equipped with a weapon that could pierce even the latest armor, they only used it against old armor, and in doing so exposed to security researchers a previously unreported vulnerability," Proofpoint said in a blog post.
New old pierce weapon armor!! âoeOld armor only âoeâoe armor! Cyber armor WEAPON,â said Armor!
Just create an "Adobe exploit" entry in the top menu and do away with the front-page articles.
Are on the right side?? Man, this is boring, almost like in all those movies.
You have been warned repeatedly that you Flash and Java plugins/addons/extensions are insecure and that you should uninstall them. Therefore, if you still have Flash or Java installed and you get compromised because of it, you only have yourself to blame.
Anons need not reply. Questions end with a question mark.
Uninstall Flash on your PC and install it in a VM with a snapshot that has a browser already open. If you encounter a website that requires flash, just open your virtual machine and paste the address. When you're done, reset the VM's snapshot to before you visited the website.
p.s. Make sure you disable bi-directional clipboard and drag-drop operations, and ffs don't mount any local folders in the VM.
âoe... and sometimes Ý.
Not a zero day exploit in Flash. Why, I'm utterly traumatized by this, my faith in humanity has been utterly ruined, why I ... oh, fuck it ...
Yawn, yet another zero day exploit in a steaming turd of a technology which has been an endless series of security holes for almost 20 years now.
And, having been largely Flash free for at least 15 of those years, all I can say is "enjoy your quality software, suckers".
Honestly, the only thing which has cumulatively had more security holes than Flash is Windows. I honestly don't know why people keep trusting it, because it really has been a terrible security risk forever, and disabling it is usually the first thing I do in a browser.
Lost at C:>. Found at C.
This might explain why I was getting all kinds of malware warnings while browsing eBay last night. Flash is so bad that Chrome started not playing it by default.
Only the State obtains its revenue by coercion. - Murray Rothbard
There's no reason to support Unicode on a site like this. It primary targets an English audience. Anything worth expressing here can be expressed using ASCII.
The last thing Slashdot needs is spam in Russian and Chinese, or stupid Japanese-style kaomoji emoticons, or idiotic emoji characters all over, or people drawing stupid shit with other Unicode characters.
Yeah, maybe Unicode is useful if your audience is primary Chinese-speaking, but that's not the case here. Unicode would be far more harmful than helpful.
Besides, there are a lot of other more important things to deal with first. Like fixing the goddamn moderation and metamoderation systems. I have to constantly browse at -1 because the best content here ends up incorrectly modded down. The broken metamoderation system obviously isn't helping fix this problem, either. Shit, at this point I'd rather see the Slashdot devs spend their time and effort removing the moderation and metamoderation systems completely, rather than dicking around with Unicode support.
They got what they wanted , didn't get greedy and walked way?
So where would it go? Some viruses reduced their lethality a lot and helped their hosts survive better so that these viruses could also survive better. At some point they benefit they added was so much, they were more symbiotes rather than a pathogen. Some eventually gave up all attempts find new host or propagation and became totally dependent on their hosts. The mitochondria in each of our cells that is actually the powerhouse that generates energy for the organisms, was once a free living bacteria [*2]. The gut bacteria of so many animals are totally dependent on their host. Some of the viruses got spliced into our DNA itself! There are genes from viruses in our DNA happily churning out proteins for us!
Malware authors can not claim copyright, nor can they enforce any intellectual property rights on their creation. There is nothing to stop OS developers from picking up useful bits of algorithms and code from these viruses and using it in legitimate code. Very interesting to think about what could happen. Of course, the biota is still full of harmful viruses and bacteria. So not all viruses will be tamed. But there is some potential to harvest these viruses for any good code/algorithm/logic they might have in them.
[*1] no no no, I am not saying these viruses are sentient and they deliberately did X to achieve Y. Some viruses did X, that was beneficial due to Y, and they survived better than the ones that did not do X, thus eventually only the viruses that did X are the only ones still alive. Anthropomorphizing and attributing purpose to an evolutionary process is simply a shorthand used by biologists. Read Daniel Dennett, he explains it far better than I do.
[*2] Endosymbiosis.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It's time for people to start "pirating" exploit kits and spreading em far and wide as 0-day releases.
Wide availability of the exploit code will force vendors to fix their shit promptly and also piss off the exploit kit developers.
How can there be so many defects in Flash? Is Adobe paid to include vulnerabilities? If so, who pays? Secret government agencies? One of the many stories: The NSA hacks other countries by buying millions of dollars worth of computer vulnerabilities.
Is Adobe badly managed?
"Honestly, the only thing which has cumulatively had more security holes than Flash is Windows."
Is Microsoft paid to include vulnerabilities? Or is it bad management? "Monkey Boy" can't run a technology company?
So if there is an interesting, innovative, novel device in some virus, will it be counted as prior art? The security researchers who see this code first hand might try to patent it, of course. Now USPTO has moved from first-to-invent to first-to-file. So they might even get the patent, but only if they do it within one year since it was released. Has anyone cited some work in a virus to argue challenge a patent claim as not-novel, covered by prior art?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Every vulnerability is zero-day until a patch comes out addressing it.