Slashdot Mirror
New Zero-Day Vulnerability Found In Adobe Flash Player (gbhackers.com)
GBHackers On Cyber Security and an anonymous Slashdot reader have shared a story about a new zero-day vulnerability found in Adobe's Flash Player. Bleeping Computer reports: South Korean authorities have issued a warning regarding a brand new Flash zero-day deployed in the wild. According to a security alert issued by the South Korean Computer Emergency Response Team (KR-CERT), the zero-day affects Flash Player installs 28.0.0.137 and earlier. Flash 28.0.0.137 is the current Flash version number.
"An attacker can persuade users to open Microsoft Office documents, web pages, spam e-mails, etc. that contain Flash files that distribute the malicious [Flash] code," KR-CERT said. The malicious code is believed to be a Flash SWF file embedded in MS Word documents. Simon Choi, a security researcher with Hauri Inc., a South Korean security firm, says the zero-day has been made and deployed by North Korean threat actors and used since mid-November 2017. Choi says attackers are trying to infect South Koreans researching North Korea. Adobe said it plans to patch this zero-day on Monday, February 5.
"An attacker can persuade users to open Microsoft Office documents, web pages, spam e-mails, etc. that contain Flash files that distribute the malicious [Flash] code," KR-CERT said. The malicious code is believed to be a Flash SWF file embedded in MS Word documents. Simon Choi, a security researcher with Hauri Inc., a South Korean security firm, says the zero-day has been made and deployed by North Korean threat actors and used since mid-November 2017. Choi says attackers are trying to infect South Koreans researching North Korea. Adobe said it plans to patch this zero-day on Monday, February 5.
I treat Flash itself as potential malware, and consider it to be compromised at all times. Thankfully, these days you hardly ever need it anymore.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Talk about having a death-wish...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Who the fuck still uses flash or has it installed these days?
Who still uses flash these days?
Aside from all the security issues with it, I think the final nail in the coffin for flash was when they decided they were not going to support mobile devices. Since sites these days want to be as interoperable with mobile as possible that was pretty much the end of flash.
Only 5 days from public disclosure to a patch... Wouldn't wanna force y'all to work weekends, fucking jokers.
A Flash SWF file embedded in a MS Word file. What could possibly go wrong?
I wish people who use this term understood it. It is only a zero day if it was first discovered and used today. If they patch it on Monday, and it really is a zero day, then they will be patching a three day.
The problem is that in China, nearly every video website used Flash-based video players.Also, some major e-banking websites require Flash.
I do not know the exact reason, but someone said that Flash-based "web apps" are easier to make and Flash is easier to implement DRM (you know those ____ing sites that do not want you to download those videos by any means unless you sign up and pay)
Ya know, I'm wondering what the benefit of NK hackers using ransomware, or stealing cryptocurrency is. Ok they manage to transfer it to a bank in Switzerland or South Korea or whatever... now what? They can't transfer it to a NK bank because of the sanctions (not like numbers in a NK database help them). They can't buy a truckload of food and drive it over to NK because of sanctions/blockades. They can't rent a DC10 and airdrop food into NK because of DMZ/no-fly-zone/sanctions. I was wondering why the hackers, who are presumably reasonably intelligent, are doing their hacking from outside of NK, have access to the wider internet, and realize the NK propaganda is mostly BS, don't just run away, giving the middle finger to NK. Sure, maybe their family back home is being threatened by the NK government... but chances are good that their family is gonna be fucked by war and/or famine, so why wouldn't a young man just say "fuck it all" and never look back?
Last I heard, chances are good that China of all nations is going to be at war with NK, as early as next month. I'm sure they'll have zero compunction about glassing the entire country, papering over the literal fallout with propaganda if necessary. Easy way to take care of that 'refugee problem', eh? I imagine other countries would have a difficult time poo-pooing out one side of their mouth while breathing a sigh of relief from the other; ya know, aside from the actual fallout-caused problems (which would still be preferable to an errant NK nuke, assuming China doesn't use salted warheads).
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Flash is due to be end of lifed anyway, get the pain over with now rather than 2020 when there will be a panic of developers.
Steve Jobs declared the end of Flash in 2007. 10 years later (or 11 if your round really up), it has been true for a couple of years. I'm still surprised that I see Flash video from a local major content supplier. I'm not the guy to fix it, but I'll be happy to enlighten people (let's talk in fact).
I'm surprised BeauHD didn't find a way to pin the very existence of Flash on RUSSIA! RUSSIA! RUSSIA!
Oh, yeah, this is The Onion's take on the Nunes memo:
FBI Warns Republican Memo Could Undermine Faith In Massive, Unaccountable Government Secret Agencies
WASHINGTON—Stressing that such an action would be highly reckless, FBI Director Christopher Wray warned Thursday that releasing the “Nunes Memo” could potentially undermine faith in the massive, unaccountable government secret agencies of the United States. “Making this memo public will almost certainly impede our ability to conduct clandestine activities operating outside any legal or judicial system on an international scale,” said Wray, noting that it was essential that mutual trust exist between the American people and the vast, mysterious cabal given free rein to use any tactics necessary to conduct surveillance on U.S. citizens or subvert religious and political groups. “If we take away the people’s faith in this shadowy monolith exempt from any consequences, all that’s left is an extensive network of rogue, unelected intelligence officers carrying out extrajudicial missions for a variety of subjective, and occasionally personal, reasons.” At press time, Wray confirmed the massive, unaccountable government secret agencies were unaware of any wrongdoing for violating constitutional rights.
Why is anyone still using flash today exactly? Trash that crap out the uninstaller window and never use it again. It was and will always be, the biggest security risk on your computer, because Adobe can't do anything right.
The story broke on Bleeping Computer: https://twitter.com/campuscodi/status/959092532520148993
Why is that shit from GBHackers even linked here. They can barely write in English and they obviously stolen the content from the original publication.
Come on Beau, get your shit together and start promoting quality reporting.
I'm sorry, but Flash and all of its incarnations has been a gaping fucking security hole since the late 90s ... you know, as long as it has existed.
I've been disabling Flash for a very long time.
It's a steaming turd, and always has been.
At this point, I have no sympathy for anybody who gets impacted by Flash, because Flash has always been broken and insecure.
Flash should have been killed off years ago. I'm not letting some random web site run arbitrary code on my machine because I don't trust Flash. Because, how the fuck could you possibly trust Flash?
Seriously?
I'm not sure it's a zero day now it's been found and distributed.
There aren't a whole lot of addresses for the DPRK, they can't have that many computers or people with the skills to do this. Is there nothing we can do to monitor and control their access and activity?
Here we have yet another vector that APK's work fails to protect against, yet no script would prevent it.
vSphere still uses it for some stuff
South Korea embraced the internet and jumped in early. So early it forced all the banks and other agencies to use some Active X based protocol. Not sure if the country has recovered completely from that fiasco.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Flash has been riddled with security holes since it came into use. Since it is not based on any kind of standards whatsoever, no one can really review it for compliance. It's been a broken technology since its inception.
This news angered me so much that I tried seeking out removing Flash, and I was astonished at how hard it was, technically and what I'd have to give up. First surprise was Windows 10. I honestly thought Flash was just a component that could be uninstalled. How wrong I was. Turned out I would have to change ownership of system-reserved files. Cumbersome and not a pretty solution, so I postponed that project. Next I checked Google Chrome 64. Again I assumed it would just be a simple option of disabling Flash. Again wrong. Older versions of Chrome had a flag to disable Flash, Chrome 64 does not, and I honestly don't know if it's even possible to disable Flash in the latest Chrome version. All I could do was clean up white-listed websites, and while doing so I noticed one websites that I wouldn't like to part with. So, my big project of removing Flash from Chrome and Windows 10 stopped there. It's incredible that this piece of garbage Flash is still around with more holes than Swizz cheese. If holes could have holes they still wouldn't compare to crappy Flash that just don't want to die.
I removed Flash from my home computers some time ago. Now I only have access at work where it is a required application. (Boneheads.)
I work for a company that uses Security Mentor (http://www.securitymentor.com) for security training. The first time I tried to open a lesson, I was in absolute shock that I had to install flash player. I reached out to them and heard nothing back. I created a sandbox to click through their videos as quickly as possible. I mention this so perhaps the /. effect can help convince them that you cannot credibly teach security while requiring people inherently make bad security decisions to do so.
Flash is bad. Has always been bad. Needs to die. There's even an html5 zombo now and you can do everything there!
You'd be sadly amazed by the number of companies that think flash is an acceptable avenue for building interactive web properties. I frequently see it with online classes. Think school lessons, driver's education after s ticket, HR training, "security" tutorials, etc. It's sad but there are so many "developers" that adopted it a long time ago that just aren't picking up HTML5.
While Meltdown and company are getting all the attention lately, it's sort of nice to hear about something new from the folks that gave us so many classics.
CUR ALLOC 20195.....5804M
I recently purchased a cheap laptop running Windows 10 to manage an ESXi server. The voice directed setup was great, but I was shocked to see Flash installed by default. What was Microsoft thinking?
"I treat Flash itself as potential malware..."
Does Adobe sell vulnerabilities to secret agencies? There seem to be far too many vulnerabilities considering the lack of improvements in the software.
So as long as I have no Microsoft GarbageOffice software to be used with the malicious payload, Iâ(TM)m fine, right? (Happily, as I use LibreOffice, thereâ(TM)s no application to open the Microsoft GarbageOffice files, right?
(I know LibreOffice can kinda-sorta open Microsoft GarbageOffice files, but I have mine configured to refuse to load any of the internal code by default in any GarbageOffice file, so it shouldnâ(TM)t matter in my case.
But hey, itâ(TM)s been a little while since the last big, embarrassing Adobe Flash Security Fuckup, hasnâ(TM)t it?
I uninstalled Flash and stopped using Microsoft Office years ago. Haven't missed them at all.
In other astonishing news, the sun came up this morning, water is wet, and it's dang cold in Point Barrow in February.
(but the sun didn't come up in Point Barrow, Alaska.)
Why does anyone trust any application to do what it claims it will do on the tin? Isn't it the job of the Operating System to allocate and determine access to system resources, as specified by the user? We need better OSs.
NoScript doesn't do a FRACTION of what hosts do for you!
Can NoScript block & stall botnet client C&Cs? No.
Can NoScript protect vs. DNS down/poisoned? No.
Can NoScript protect vs. dns request log tracking? No.
Can NoScript protect vs. Dns blocklists? No.
Can NoScript protect vs. spam/phish malicious payloads? No.
Does NoScript speed you up 2 ways: adblocks & hardcodes? No.
NoScript operates slower parsing script src tags in usermode.
* Hosts block before noscript vs. ad & 3rd party scripts in kernelmode not slower usermode where noscript operates from also compounded in added messagepassing inside a browser & addons slow a browser which shows when stacked w/ other addons more!
APK
P.S.=> According to the source article, it's done via flash .swf files - as long as hosts have the source host-domain name blocked where it comes from, hosts do it FASTER vs. NoScript - period... apk
Adobe has such a solid reputation for being a company that produces secure and safe products, with Flash being the foremost example of this. The fact that it had a security hole like this surprises me more than a little bit. Hmm, I wonder if there could be others?
Also, remember about a year back when we were all led to believe that Flash would be going away? Good times.
Loads of fun?