Slashdot Mirror
Delete Or Update All Adobe Flash Player Instances, Experts Warn (threatpost.com)
An anonymous reader quotes an article from BankInfoSecurity:
Security experts are once again warning enterprises to immediately update -- or delete -- all instances of the Adobe Flash Player they may have installed on any system in the wake of reports that a zero-day flaw in the web browser plug-in is being targeted by an advanced persistent threat group.... The bug exists in Adobe Flash Player 21.0.0.242 and earlier versions -- running on Windows, Mac, Linux, and Chrome OS -- and "successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system."
Thursday Adobe released an updated version of Flash patching 36 separate vulnerabilities, including the critical vulnerability which "if exploited would allow malicious native-code to execute, potentially without a user being aware." While applauding Adobe's quick response, researchers at Kaspersky Lab say it's already been exploited in Russia, Nepal, South Korea, China, India, Kuwait and Romania, and BankInfoSecurity writes that "The latest warning over this campaign reinforces just how often APT attackers target Flash, thus making a potential business case for banning it for inside the enterprise."
Flash is literally a zombie at this point.
But if we stick with HTML5-based technologies, then we'll just be more easily tracked by advertisers.
I am not sure what you based this on - one of Flash's big selling points to advertisers has been just how much info it can provide to them about your browsing habits.
#DeleteChrome
It's only a Flash zero-day that abuses Windows DDE via a six-step process (Flash - DLL file - Windows DDE - LNK file - VBS Script - CAB file). This zero-day is specific to nation-backed hackers, not average exploit kit skids. The exploitation process is just to hard to follow through, and Microsoft EMET detects it as well. So... it's not really that dangerous ffs
"Flash is literally a zombie at this point."
Big problem: Adobe Flash is a "zombie" to technically knowledgeable people who read a lot of technology news. For most people, Flash makes their computers vulnerable.
Is Adobe selling vulnerabilities to hidden parts of the U.S. government, or to other organizations, and fixing the vulnerabilities only after they are discovered publicly? Or is Adobe management so incompetent that there are 10 or 20 or, in this case, 36 vulnerabilities in every version? In either case, the large number of vulnerabilities seem to be a strong advertisement not to install Adobe products on computers that have a connection to other computers or to the internet.
I count 11 new versions of Adobe Flash in 10 months.
The best story I've found about this month's Adobe Flash vulnerabilities is this one: Kill Flash now. Or patch these 36 vulnerabilities. Your choice.
I see web pages that don't need Adobe Flash Player using it anyway. Is that because most people don't use the Better Privacy browser add-on? Flash makes what are called persistent cookies. Better Privacy deletes persistent cookies.
Every time I start Adobe Acrobat Professional, it asks to connect to the internet in 3 different ways. So, when I want to make a PDF file, I generally use the free Bullzip PDF printer.
Because I have no way of knowing what Adobe is doing or hiding, I generally use the free Sumatra PDF Reader.
To me, it seems that Adobe is engineering such a bad reputation for itself that it will eventually put itself out of business. (It seems that Microsoft is following the Adobe methods. Windows 10 seems to be intentionally vulnerable. Microsoft products also have huge numbers of vulnerabilities.)
Flash Player (PPAPI version) for Linux is current. Flash Player (NPAPI version) 11.2 for Linux is outdated but in extended support until May 2017, during which it gets security updates but no new features. Fresh Player is a wrapper plug-in for an NPAPI browser that hosts PPAPI plug-ins.
Embedding HTML5 Youtbe videos works just fine. The problem is that the web site you went to used an older embed method that defaults to Flash.
You could install flashblock and only allow flash content that you actually need. It cuts down on security threats and ads.