Slashdot Mirror

← Back to Stories (view on slashdot.org)

Delete Or Update All Adobe Flash Player Instances, Experts Warn (threatpost.com)

Posted by EditorDavid on from the Flash-in-the-pan dept.

An anonymous reader quotes an article from BankInfoSecurity: Security experts are once again warning enterprises to immediately update -- or delete -- all instances of the Adobe Flash Player they may have installed on any system in the wake of reports that a zero-day flaw in the web browser plug-in is being targeted by an advanced persistent threat group.... The bug exists in Adobe Flash Player 21.0.0.242 and earlier versions -- running on Windows, Mac, Linux, and Chrome OS -- and "successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system." Thursday Adobe released an updated version of Flash patching 36 separate vulnerabilities, including the critical vulnerability which "if exploited would allow malicious native-code to execute, potentially without a user being aware." While applauding Adobe's quick response, researchers at Kaspersky Lab say it's already been exploited in Russia, Nepal, South Korea, China, India, Kuwait and Romania, and BankInfoSecurity writes that "The latest warning over this campaign reinforces just how often APT attackers target Flash, thus making a potential business case for banning it for inside the enterprise."

36 of 172 comments (clear)

  1. Well by johnsmithperson123 · · Score: 5, Informative

    Flash is literally a zombie at this point.

    1. Re:Well by 93+Escort+Wagon · · Score: 5, Informative

      Flash is literally a zombie at this point.

      Yeah, I removed the Flash plugin from my computer maybe a year ago. Prior to that, I'd been running ClickToFlash for several years... but then I realized just how infrequently I actually "clicked" to enable anything. Plus Adobe's insistence on installing it for all users, and with admin privileges to boot - really ridiculous, especially given Flash's horrible track record.

      Since Chrome has Flash built in, and since I don't use Chrome as my main browser - if there's ever something Flash-based I actually want to access, I just launch that browser. But I can't remember the last time I actually did that...

      --
      #DeleteChrome
    2. Re:Well by macs4all · · Score: 2

      Flash is literally a zombie at this point.

      Yeah, I removed the Flash plugin from my computer maybe a year ago. Prior to that, I'd been running ClickToFlash for several years... but then I realized just how infrequently I actually "clicked" to enable anything. Plus Adobe's insistence on installing it for all users, and with admin privileges to boot - really ridiculous, especially given Flash's horrible track record.

      Since Chrome has Flash built in, and since I don't use Chrome as my main browser - if there's ever something Flash-based I actually want to access, I just launch that browser. But I can't remember the last time I actually did that...

      My 2013 MacBook Pro didn't come with Flash installed. I counted that as a Feature.

      2016, and that MBP is still blissfully Flash-Free...

      Don't miss it at all.

    3. Re:Well by ChunderDownunder · · Score: 2

      At least once a week I encounter a news website where HTML5 won't play a video either through buffering or failing to start.Flash STILL seems to handle those cases better.

      main browser: Firefox (no flash), flash browser (Chrome)

  2. So we're fucked either way? by Anonymous Coward · · Score: 5, Insightful

    Ok, so if we stick with Flash we might be subjected to security problems.

    But if we stick with HTML5-based technologies, then we'll just be more easily tracked by advertisers.

    Sounds like we are fucked in both cases!

    1. Re:So we're fucked either way? by 93+Escort+Wagon · · Score: 5, Informative

      But if we stick with HTML5-based technologies, then we'll just be more easily tracked by advertisers.

      I am not sure what you based this on - one of Flash's big selling points to advertisers has been just how much info it can provide to them about your browsing habits.

      --
      #DeleteChrome
    2. Re:So we're fucked either way? by NotInHere · · Score: 2

      Flash isn't much better in the regards of tracking than the html5 based technologies. Maybe flash ships with its own fonts, not relying on the OS fonts so you cant fingerprint basing on the fonts. But otherwise flash is in fact better for ad based tracking because you can't disable parts of it, you either take it all, or nothing of it.

      Whoever told you that HTML5 allows better tracking than flash, is just outright wrong.

      In fact, in the past flash has allowed so-called "supercookies", dunno if they are still enabled.

      If you wanted to disable them, you had to visit the adobe website. How comforting to know that adobe can change whether I enable supercookies or not.

    3. Re:So we're fucked either way? by bloodhawk · · Score: 5, Insightful

      With flash you get the WORST of both. you get the tracking AND the security problems.

  3. Porn by Anonymous Coward · · Score: 3, Insightful

    There's a reason all the adult sites are going to HTML5 over Flash for video. You know your platform is outdated and totally not worthwhile when the porn industry abandons you.

  4. The problem isn't flash by BarbaraHudson · · Score: 2

    Ban indiscriminate access to the internet and watch how the problems fade away.

    --
    "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    1. Re:The problem isn't flash by Anonymous Coward · · Score: 2, Insightful

      APK's internet access should be banned.

  5. let this be a lesson by RichMan · · Score: 4, Insightful

    The once dominant interactive web "standard" is dead.
    What killed it? Security problems.

    For the web, security needs to the number one priority considered from day one when the architecture, specifications and scope of the project are first looked at.

    1. Re:let this be a lesson by guruevi · · Score: 5, Insightful

      Flash was never a "standard". I've always recommended clients to get rid of Flash sites because it wasn't a standard and not everyone could use it. When Flash was first introduced, a large number of people were still on dial-up and Flash sites were a big no-no because by then we already knew that people would click away if their site didn't load in 5s or less. Flash was then marketed towards people marketing towards broadband (video and interactive sites and DHTML were going to be all the rage once everyone got broadband).

      When everyone started getting broadband, companies like Google sprang up (or rather, became embedded in the culture) and "SEO" became the buzzword, Google wasn't Flash-aware or compatible, Flash was dead as a 'standard' platform for 'broadband' because no 3rd party company (outside Macromedia and later Adobe) wanted to support it.

      It eventually got taken over by Adobe and it was dead then because nobody trusted Adobe to fix it. It had many security issues already and many compatibility issues even within it's own tools. Adobe never fixed it, they just kind of half-integrated it with the rest of their suite but they effectively put it on life support. When Apple released the iPhone, Flash was dead and now it's just being this zombie process you know you have to get rid of at some point, but you don't really want to because maybe you may need it in some obscure corner of the web.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    2. Re:let this be a lesson by Billly+Gates · · Score: 2

      Did you read the part about work??

      Shit enterprise IT is always way behind since the turn of the century and hasn't been an innovator of newer stuff since the .com crash which now views IT as a cost and not an asset.

      We can't update at work. This would require software to be updated that requires a monthly subscription of over $1000 a month! Why? So audio will work now in which flash version 16 works just fine?! Oh you say record in HTML 5?

      OOps. Not happening as our clients still use IE 6 and they pay our bills. We use a website through server 2003 for all critical data which is HIPPA (facepalm) and the site will work up to IE 8 through quirks mode in 1999 IE 5.5 mode to display the flash training material which won't work with audio in any version above flash 16.

      If you say something to the customer you will be fired at work. You are not authorized as IT and your boss and his boss is not authorized either and needs VP approval for a request like that to update. Also they can go to a competitor if we do not comply and we can't ahve that happening.

      So yes your own pc is one thing but at work we have lots and lots of things that will never be ported thanks to Adobe greed with renting software and lots of things that need to be re-encoded or can't ever be re-encoded for compatibility.

      --
      http://saveie6.com/
    3. Re:let this be a lesson by Solandri · · Score: 3, Interesting

      When Flash was first introduced, a large number of people were still on dial-up and Flash sites were a big no-no because by then we already knew that people would click away if their site didn't load in 5s or less. Flash was then marketed towards people marketing towards broadband (video and interactive sites and DHTML were going to be all the rage once everyone got broadband).

      You've got that backwards. The very reason Flash exists was to reach people trying to access the Internet on dialup. Dialup wasn't fast enough to stream video, but real-life video is different from animation. Flash was originally an artist's tool to allow animation over dialup. Instead of having to send a constant video stream, you could send a few sprites and images of backgrounds, then animate those on the user's local computer.

      It was only later when web developers realized that Flash was flexible enough to essentially run universal interpreted code (same code would work on PC, Mac, and Linux) that they went nuts. Entire websites in flash, thus defeating the whole purpose of HTML (displaying info in the format the end-user decided was best). Flash ads bypassing the user blocking animated GIF ads. And flash streaming video became ubiquitous (which wouldn't have happened if the folks at W3C had actually added the features web developers were asking for like embedded streaming video, instead of waiting 10 years like they did with HTML 5).

      That's why Flash is so full of security holes. Because when Macromedia invented it, they were just thinking of a a good way to animate stuff on the end user's PC. They had no idea it was going to become The way for web developers to do everything they wanted but couldn't because "HTML didn't support it." It's still an excellent animation tool. A large number of animated TV shows and animated movies are partly or completely made with Flash.

  6. Weekly Flash Warning. 7 Days Til Next Alert. by zenlessyank · · Score: 5, Insightful

    Since you haven't listened to the 483 times we have told you before, we will tell you again. Uninstall Flash Player. That is all.

  7. And Shame on Adobe by dmomo · · Score: 5, Insightful

    For undermining security to try and trick users into installing McAffe when upgrading. That should be opt IN not opt OUT.

    1. Re:And Shame on Adobe by dmomo · · Score: 2

      Trying to monetize the security upgrade process just reveals that you have an incentive to ship an insecure product.

    2. Re:And Shame on Adobe by radarskiy · · Score: 2

      They offer hand-crafted artisanal crapware.

  8. And no Linux version by crow · · Score: 2

    Adobe hasn't released a Linux version since version 11. Unless there's a big surprise, there's no option for Linux users but to give up on Flash entirely.

  9. Re:Just Nuke Adobe by NatasRevol · · Score: 2

    Next version of macOS will also disable it by default.

    --
    There are two types of people in the world: Those who crave closure
  10. Re:Threats from the future? by SeaFox · · Score: 2

    Oops. Misread that there. 22.0.0.192.
    LOL. Carry on, I'm an idiot.

  11. Misleading much? by campuscodi · · Score: 3, Informative

    It's only a Flash zero-day that abuses Windows DDE via a six-step process (Flash - DLL file - Windows DDE - LNK file - VBS Script - CAB file). This zero-day is specific to nation-backed hackers, not average exploit kit skids. The exploitation process is just to hard to follow through, and Microsoft EMET detects it as well. So... it's not really that dangerous ffs

  12. Re:HTML5 promo ? by Motherfucking+Shit · · Score: 2

    Unfortunately, most NOAA/NWS radar products still require Flash. Livestream, which powers my local TV news broadcasts, also uses a Flash based player. There are a few other use cases for me personally, most of them being government entities.

    --
    "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
  13. alright... so have we learned yet? by Anonymous Coward · · Score: 2, Insightful

    Flash, Javascript, ActiveX... have we learned now?

    Letting random web sites run any form of procedural code on your computer is NOT a good idea. Not just random web sites, but any site THEY in turn want to cross site script. Even when you try to sandbox this stuff, there are still holes. The valid use cases for such scripting are minuscule - it is chiefly used for advertising, tracking, profiling, and interfering with the user experience such as disabling cut and paste. For the very few valid use cases, it can be whitelisted.

    But default-enabled? That's insane, no matter what the web-language flavor of the day is.

    Captcha = mishap

  14. Is Adobe paid for deliberate vulnerabilities? by Futurepower(R) · · Score: 4, Informative

    "Flash is literally a zombie at this point."

    Big problem: Adobe Flash is a "zombie" to technically knowledgeable people who read a lot of technology news. For most people, Flash makes their computers vulnerable.

    Is Adobe selling vulnerabilities to hidden parts of the U.S. government, or to other organizations, and fixing the vulnerabilities only after they are discovered publicly? Or is Adobe management so incompetent that there are 10 or 20 or, in this case, 36 vulnerabilities in every version? In either case, the large number of vulnerabilities seem to be a strong advertisement not to install Adobe products on computers that have a connection to other computers or to the internet.

    I count 11 new versions of Adobe Flash in 10 months.

    The best story I've found about this month's Adobe Flash vulnerabilities is this one: Kill Flash now. Or patch these 36 vulnerabilities. Your choice.

    I see web pages that don't need Adobe Flash Player using it anyway. Is that because most people don't use the Better Privacy browser add-on? Flash makes what are called persistent cookies. Better Privacy deletes persistent cookies.

    Every time I start Adobe Acrobat Professional, it asks to connect to the internet in 3 different ways. So, when I want to make a PDF file, I generally use the free Bullzip PDF printer.

    Because I have no way of knowing what Adobe is doing or hiding, I generally use the free Sumatra PDF Reader.

    To me, it seems that Adobe is engineering such a bad reputation for itself that it will eventually put itself out of business. (It seems that Microsoft is following the Adobe methods. Windows 10 seems to be intentionally vulnerable. Microsoft products also have huge numbers of vulnerabilities.)

    1. Re:Is Adobe paid for deliberate vulnerabilities? by macs4all · · Score: 4, Informative

      That's one of the things I have always liked about OS X: Native PDF support for both Reading and Writing PDFs.

    2. Re:Is Adobe paid for deliberate vulnerabilities? by macs4all · · Score: 2, Informative

      Windows 10 does as well now...

      Wow, I'm impressed! OS X has only had that for sixteen years (Hint: Since OS X 10.0.0)...

  15. Just under a year of extended support left by tepples · · Score: 3, Informative

    Flash Player (PPAPI version) for Linux is current. Flash Player (NPAPI version) 11.2 for Linux is outdated but in extended support until May 2017, during which it gets security updates but no new features. Fresh Player is a wrapper plug-in for an NPAPI browser that hosts PPAPI plug-ins.

  16. How to convince users to whitelist your web app? by tepples · · Score: 2

    For the very few valid use cases, [SWF, JavaScript, or WebAssembly] can be whitelisted.

    Among these "very few valid use cases" are web applications, such as Google Docs and Slashdot,* and sites offering vector-based animations, such as Homestar Runner and Weebl's Stuff. So how should the operator of a website hosting a web application go about demonstrating to users that the application is among these "very few valid use cases"?

    * Try loading more than the 100 top-scored comments without script. If you succeed, reply and let me know what you pushed.

  17. Can't get rid of Flash yet by jonwil · · Score: 4, Interesting

    I tried removing Flash from my SeaMonkey install and that lasted all of 5 minutes before I found a forum post with an embedded YouTube clip that I couldn't play (and wanted to play). So I can't ditch Flash yet (at least not until YouTube comes up with a way to embed YouTube clips into forum posts, blog posts etc etc without needing Flash installed)

    1. Re:Can't get rid of Flash yet by Anonymous Coward · · Score: 2, Informative

      Embedding HTML5 Youtbe videos works just fine. The problem is that the web site you went to used an older embed method that defaults to Flash.

    2. Re:Can't get rid of Flash yet by melting_clock · · Score: 3, Informative

      You could install flashblock and only allow flash content that you actually need. It cuts down on security threats and ads.

  18. Re:Blocking SWF vs. blocking HTML5 by thegarbz · · Score: 2

    I tried that once, but I'm old fashioned enough to actually just expect something to work when I access a page, not visit page, damn, enable the first script ... damn, enable the second script ... damn, enable the third script ... yay content works, but links don't ... damn, etc etc.

    It was actually exhausting using the internet with scripting disabled by default.

    Personally I just now block ads. Let them build up a profile of what they should be selling me. It's not like I see their junk.

  19. Re:I need the Weather by Andreas+Mayer · · Score: 2

    This website does not work in Firefox without the Flash Plugin.

    http://www.ssd.noaa.gov/goes/east/carb/flash-rb.html

    I use this website every day.
    Any suggestions.

    Use the non-flash version?

    http://www.goes.noaa.gov/dml/e...

    Or ist that somehow not good enough? I can't compare; no Flash installed. :P

  20. Re:Blocking SWF vs. blocking HTML5 by MadMaverick9 · · Score: 2

    So?

    What's the problem?

    You don't want me to see your webpage. Then I simply don't.

    I don't give a flying fuck.