Delete Or Update All Adobe Flash Player Instances, Experts Warn (threatpost.com)

An anonymous reader quotes an article from BankInfoSecurity: Security experts are once again warning enterprises to immediately update -- or delete -- all instances of the Adobe Flash Player they may have installed on any system in the wake of reports that a zero-day flaw in the web browser plug-in is being targeted by an advanced persistent threat group.... The bug exists in Adobe Flash Player 21.0.0.242 and earlier versions -- running on Windows, Mac, Linux, and Chrome OS -- and "successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system." Thursday Adobe released an updated version of Flash patching 36 separate vulnerabilities, including the critical vulnerability which "if exploited would allow malicious native-code to execute, potentially without a user being aware." While applauding Adobe's quick response, researchers at Kaspersky Lab say it's already been exploited in Russia, Nepal, South Korea, China, India, Kuwait and Romania, and BankInfoSecurity writes that "The latest warning over this campaign reinforces just how often APT attackers target Flash, thus making a potential business case for banning it for inside the enterprise."

Comments

Well

[johnsmithperson123]

Flash is literally a zombie at this point.

Re:Well

[93 Escort Wagon]

Flash is literally a zombie at this point.

Yeah, I removed the Flash plugin from my computer maybe a year ago. Prior to that, I'd been running ClickToFlash for several years... but then I realized just how infrequently I actually "clicked" to enable anything. Plus Adobe's insistence on installing it for all users, and with admin privileges to boot - really ridiculous, especially given Flash's horrible track record.

Since Chrome has Flash built in, and since I don't use Chrome as my main browser - if there's ever something Flash-based I actually want to access, I just launch that browser. But I can't remember the last time I actually did that...

So we're fucked either way?

[Anonymous Coward]

Ok, so if we stick with Flash we might be subjected to security problems.

But if we stick with HTML5-based technologies, then we'll just be more easily tracked by advertisers.

Sounds like we are fucked in both cases!

Re:So we're fucked either way?

[93 Escort Wagon]

But if we stick with HTML5-based technologies, then we'll just be more easily tracked by advertisers.

I am not sure what you based this on - one of Flash's big selling points to advertisers has been just how much info it can provide to them about your browsing habits.

Re:So we're fucked either way?

[bloodhawk]

With flash you get the WORST of both. you get the tracking AND the security problems.

Weekly Flash Warning. 7 Days Til Next Alert.

[zenlessyank]

Since you haven't listened to the 483 times we have told you before, we will tell you again. Uninstall Flash Player. That is all.

And Shame on Adobe

[dmomo]

For undermining security to try and trick users into installing McAffe when upgrading. That should be opt IN not opt OUT.

Re:let this be a lesson

[guruevi]

Flash was never a "standard". I've always recommended clients to get rid of Flash sites because it wasn't a standard and not everyone could use it. When Flash was first introduced, a large number of people were still on dial-up and Flash sites were a big no-no because by then we already knew that people would click away if their site didn't load in 5s or less. Flash was then marketed towards people marketing towards broadband (video and interactive sites and DHTML were going to be all the rage once everyone got broadband).

When everyone started getting broadband, companies like Google sprang up (or rather, became embedded in the culture) and "SEO" became the buzzword, Google wasn't Flash-aware or compatible, Flash was dead as a 'standard' platform for 'broadband' because no 3rd party company (outside Macromedia and later Adobe) wanted to support it.

It eventually got taken over by Adobe and it was dead then because nobody trusted Adobe to fix it. It had many security issues already and many compatibility issues even within it's own tools. Adobe never fixed it, they just kind of half-integrated it with the rest of their suite but they effectively put it on life support. When Apple released the iPhone, Flash was dead and now it's just being this zombie process you know you have to get rid of at some point, but you don't really want to because maybe you may need it in some obscure corner of the web.