Slashdot Mirror
Adobe Patches Flash Zero-Day Exploited By Magnitude Exploit Kit (securityweek.com)
wiredmikey writes: Adobe released a Flash Player update on Thursday night to patch a zero-day vulnerability that has been leveraged by cybercriminals to deliver malware via the Magnitude exploit kit. The vulnerability [CVE-2016-1019], a memory corruption that can be exploited for remote code execution, was discovered after, on April 2, security researcher Kafeine of Proofpoint noticed a change in the Magnitude exploit kit. The sample was then investigated by FireEye, which determined that Magnitude EK had been exploiting a previously unknown vulnerability in Flash Player."Despite the fact that this new exploit could potentially work on any version of Adobe Flash, including a fully patched instance of Flash, the threat actors implemented it in a manner that only targeted older versions of Flash. In other words, equipped with a weapon that could pierce even the latest armor, they only used it against old armor, and in doing so exposed to security researchers a previously unreported vulnerability," Proofpoint said in a blog post.
New old pierce weapon armor!! âoeOld armor only âoeâoe armor! Cyber armor WEAPON,â said Armor!
You have been warned repeatedly that you Flash and Java plugins/addons/extensions are insecure and that you should uninstall them. Therefore, if you still have Flash or Java installed and you get compromised because of it, you only have yourself to blame.
Anons need not reply. Questions end with a question mark.
Not a zero day exploit in Flash. Why, I'm utterly traumatized by this, my faith in humanity has been utterly ruined, why I ... oh, fuck it ...
Yawn, yet another zero day exploit in a steaming turd of a technology which has been an endless series of security holes for almost 20 years now.
And, having been largely Flash free for at least 15 of those years, all I can say is "enjoy your quality software, suckers".
Honestly, the only thing which has cumulatively had more security holes than Flash is Windows. I honestly don't know why people keep trusting it, because it really has been a terrible security risk forever, and disabling it is usually the first thing I do in a browser.
Lost at C:>. Found at C.
This might explain why I was getting all kinds of malware warnings while browsing eBay last night. Flash is so bad that Chrome started not playing it by default.
Only the State obtains its revenue by coercion. - Murray Rothbard
"SAFETY IS OUR GOAL: It has been [ 2 ] days since our last Adobe Flash 0-day exploit."
Much more simple to add a permanent banner that says "Security warning: uninstall Flash from your computer".
So where would it go? Some viruses reduced their lethality a lot and helped their hosts survive better so that these viruses could also survive better. At some point they benefit they added was so much, they were more symbiotes rather than a pathogen. Some eventually gave up all attempts find new host or propagation and became totally dependent on their hosts. The mitochondria in each of our cells that is actually the powerhouse that generates energy for the organisms, was once a free living bacteria [*2]. The gut bacteria of so many animals are totally dependent on their host. Some of the viruses got spliced into our DNA itself! There are genes from viruses in our DNA happily churning out proteins for us!
Malware authors can not claim copyright, nor can they enforce any intellectual property rights on their creation. There is nothing to stop OS developers from picking up useful bits of algorithms and code from these viruses and using it in legitimate code. Very interesting to think about what could happen. Of course, the biota is still full of harmful viruses and bacteria. So not all viruses will be tamed. But there is some potential to harvest these viruses for any good code/algorithm/logic they might have in them.
[*1] no no no, I am not saying these viruses are sentient and they deliberately did X to achieve Y. Some viruses did X, that was beneficial due to Y, and they survived better than the ones that did not do X, thus eventually only the viruses that did X are the only ones still alive. Anthropomorphizing and attributing purpose to an evolutionary process is simply a shorthand used by biologists. Read Daniel Dennett, he explains it far better than I do.
[*2] Endosymbiosis.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
How can there be so many defects in Flash? Is Adobe paid to include vulnerabilities? If so, who pays? Secret government agencies? One of the many stories: The NSA hacks other countries by buying millions of dollars worth of computer vulnerabilities.
Is Adobe badly managed?
"Honestly, the only thing which has cumulatively had more security holes than Flash is Windows."
Is Microsoft paid to include vulnerabilities? Or is it bad management? "Monkey Boy" can't run a technology company?
So if there is an interesting, innovative, novel device in some virus, will it be counted as prior art? The security researchers who see this code first hand might try to patent it, of course. Now USPTO has moved from first-to-invent to first-to-file. So they might even get the patent, but only if they do it within one year since it was released. Has anyone cited some work in a virus to argue challenge a patent claim as not-novel, covered by prior art?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Every vulnerability is zero-day until a patch comes out addressing it.