Slashdot Mirror
Adobe Flash Responsible For Six of the Top 10 Bugs Used By Exploit Kits In 2016 (onthewire.io)
Trailrunner7 quotes a report from On the Wire: Vulnerabilities in Flash and Internet Explorer dominated the exploit kit landscape in the last year, with a high-profile bug in Flash being found in seven separate kits, new research shows. Exploit kits have long been a key tool in the arsenal of many attackers, from low-level gangs to highly organized cybercrime crews. Their attraction stems from their ease of use and the ability for attackers to add exploits for new vulnerabilities as needed. While there are dozens of exploit kits available, a handful of them attract the most use and attention, including Angler, Neutrino, Nuclear, and Rig. Researchers at Recorded Future looked at more than 140 exploit kits and analyzed which exploits appeared in the most kits in the last year, and it's no surprise that Flash and IE exploits dominated the landscape. Six of the top 10 most-refquently targeted vulnerabilities in the last year were in Flash, while the other four were in Microsoft products, including IE, Windows, and Silverlight. Flash has been a favorite target for attackers for a long time, for two main reasons: it's deployed on hundreds of millions of machines, and it has plenty of vulnerabilities. Recorded Future's analysis shows that trend is continuing, and one Flash bug disclosed October 2015 was incorporated into seven individual exploit kits. The flaw was used by a number of high-level attackers, including some APT groups. "Adobe Flash Player's CVE-2015-7645, number 10 in terms of references to exploit kits, stands out as the vulnerability with the most adoption by exploit kits. Exploit kits adopting the Adobe bug in the past year include Neutrino, Angler, Magnitude, RIG, Nuclear Pack, Spartan, and Hunter," the analysis by Recorded Future says.
We're proud to have 6/10 of the top bugs and will work hard to have even more in the top 10 next year.
The operating system is responsible for all of the bugs.
“He’s not deformed, he’s just drunk!”
How can *one* piece of software have so many fucking critical vulnerabilities over the years? Seriously, Flash has had new exploits just about every month, going back 10 years or more. There comes a point where the opposite of Hanlon's razor becomes likely; this simply can't be incompetence anymore, it must be malice. Is the NSA running the show at Adobe or something?
It's just a friendly competition is all. The Adobe Flash team has a lot of work ahead of them still to catch up to Adobe Reader as the all-time champion of browser-based attack vectors. However they're giving it their best shot.
Better known as 318230.
We could make it even more annoying than it is now. Rather than just having to be updated every time you use it, the model that Windows users are familiar with when they run Adobe Reader, make it update two or three times during the playing of each video. Websites will have to stop using it.
So has anyone written an open source version of the Flash browser plug-in?
Shai Schticks:"You don't make peace with friends, you make peace with enemies"
"I'd never know 'cause I [don't use] the filthy motherfucker." -- Jules, Pulp Fiction
only 6 of top 10, wow I did not realise Adobe had improved things so much, perhaps their is hope for them yet.
You give them credit for Postscript and for pdf. Pdf is essentially Postscript, zipped, with some of the code commented out. So really they deserve credit just for Postscript.
Except that postscript was largely created at Xerox PARC, before John Warnock and Chuck Geschke left. Warnock and Geschke wanted Xerox to sell Postscript (then called Interpress) as a standalone product, but Xerox chose not to. So the two left and created Adobe to sell Xerox's idea.
So anyway their one great thing, Postscript, wasn't created by Adobe.
In the days when cross-browser Javascript/Actionscript was darn near impossible, Adobe Flash was *conceptually* a good idea - a plugin that carried the same dialect of JavaScript/Emacscript to every browser. Unfortunately they really, really suck at security.
Is there something instrinsic about the functions that Adode Flash does that makes this inevitable or is it that Adobe started with an unfixable design model or is it that Adobe is incompetent. Offhand I don't see a fourth option. Well maybe just bad luck.
SO for example. In the first option, we can compare the functionality of adobe to other systems. Silver light or H264 is not the same thing since unless I'm mistaken Adobe flash is not just a codec but also a language. So a better point of comparison is Java. If it's a matter of functionality leading to intrinsic vulnerabilities in a browser setting then one would expect Java and Flash to have the same frequency of exploits. Perhaps what saves Java is that it's usually off by default and asks permission to run.
Alternatively if it's an unfixable design model, I don't see a dimes worth of difference between this an incompetence except that the former is worse because one knows the design was incompetent but persists in selling it. It's like the difference between premeditated murder and manslaughter..
So given they could eliminate most expoits why don't all browsers quarantine Adobe or classify it as suspect malware.
Some drink at the fountain of knowledge. Others just gargle.
I have stated in the past what an utter disaster Java and Flash are, and have been pounded for my opinion. So be it.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
This article shows how wide the skills gap really is. By Slashdot standards, the vast majority of computer users are tech-illiterate. What we take for granted -- for example, knowing anything about Flash security -- is completely beyond them. The linked article also fixes this divide as the reason UI is hard: if you are capable of making one, you are ipso facto not able to judge the needs of the average user. My perspective on this has always been that some of humanity has to sacrifice our brains to this technological morass that we have developed, and the rest of humanity is much happier not knowing. We just have to accept that the rest of humanity is perfectly able to lead rich, fulfilling lives without having to give a shit about Flash vulnerabilities, and try to deal with the consequences as best we can.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
The article is quiet about Google NaCl (=Native client) + Pepper that jail Adobe Flash to be harmless no matter how insecure it is.