Delete Or Update All Adobe Flash Player Instances, Experts Warn (threatpost.com)

An anonymous reader quotes an article from BankInfoSecurity: Security experts are once again warning enterprises to immediately update -- or delete -- all instances of the Adobe Flash Player they may have installed on any system in the wake of reports that a zero-day flaw in the web browser plug-in is being targeted by an advanced persistent threat group.... The bug exists in Adobe Flash Player 21.0.0.242 and earlier versions -- running on Windows, Mac, Linux, and Chrome OS -- and "successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system." Thursday Adobe released an updated version of Flash patching 36 separate vulnerabilities, including the critical vulnerability which "if exploited would allow malicious native-code to execute, potentially without a user being aware." While applauding Adobe's quick response, researchers at Kaspersky Lab say it's already been exploited in Russia, Nepal, South Korea, China, India, Kuwait and Romania, and BankInfoSecurity writes that "The latest warning over this campaign reinforces just how often APT attackers target Flash, thus making a potential business case for banning it for inside the enterprise."

Comments

Can't get rid of Flash yet

[jonwil]

I tried removing Flash from my SeaMonkey install and that lasted all of 5 minutes before I found a forum post with an embedded YouTube clip that I couldn't play (and wanted to play). So I can't ditch Flash yet (at least not until YouTube comes up with a way to embed YouTube clips into forum posts, blog posts etc etc without needing Flash installed)

Re:let this be a lesson

[Solandri]

When Flash was first introduced, a large number of people were still on dial-up and Flash sites were a big no-no because by then we already knew that people would click away if their site didn't load in 5s or less. Flash was then marketed towards people marketing towards broadband (video and interactive sites and DHTML were going to be all the rage once everyone got broadband).

You've got that backwards. The very reason Flash exists was to reach people trying to access the Internet on dialup. Dialup wasn't fast enough to stream video, but real-life video is different from animation. Flash was originally an artist's tool to allow animation over dialup. Instead of having to send a constant video stream, you could send a few sprites and images of backgrounds, then animate those on the user's local computer.

It was only later when web developers realized that Flash was flexible enough to essentially run universal interpreted code (same code would work on PC, Mac, and Linux) that they went nuts. Entire websites in flash, thus defeating the whole purpose of HTML (displaying info in the format the end-user decided was best). Flash ads bypassing the user blocking animated GIF ads. And flash streaming video became ubiquitous (which wouldn't have happened if the folks at W3C had actually added the features web developers were asking for like embedded streaming video, instead of waiting 10 years like they did with HTML 5).

That's why Flash is so full of security holes. Because when Macromedia invented it, they were just thinking of a a good way to animate stuff on the end user's PC. They had no idea it was going to become The way for web developers to do everything they wanted but couldn't because "HTML didn't support it." It's still an excellent animation tool. A large number of animated TV shows and animated movies are partly or completely made with Flash.