Emergency Adobe Flash Patch Fixes Zero-Day Under Attack 71
msm1267 writes: Adobe has released an emergency patch for a Flash zero-day used in targeted attacks by APT3, the same group behind 2014's Clandestine Fox attacks. Adobe said Flash Player 18.0.0.161 and earlier for Windows and Macintosh systems are affected, as is 11.2.202.466 for Linux 11.x versions.
The current iteration of Clandestine Fox attacks shares many traits with last year's attacks, including generic, almost spam-like phishing emails intent on snaring as many victims as possible that can be analyzed for their value before additional attacks are carried out. The two campaigns also share the same custom backdoor called SHOTPUT, as well as an insistence on using a throwaway command and control infrastructure.
The current iteration of Clandestine Fox attacks shares many traits with last year's attacks, including generic, almost spam-like phishing emails intent on snaring as many victims as possible that can be analyzed for their value before additional attacks are carried out. The two campaigns also share the same custom backdoor called SHOTPUT, as well as an insistence on using a throwaway command and control infrastructure.
Re: (Score:2)
Re: (Score:2)
Actually, a tall whiskey now and them makes the Flu quite a bit more bearable. I do agree on your intended meaning though.
Re: Relation to CryptoWall virus? (Score:2)
Are you insane? From a business standpoint they don't give a shit about your privacy. If anything it should have already been blocked.
Re: (Score:2)
I still don't get why this isn't filtered / stopped on a national level. Surely the cost would be justified in savings to the masses.
Protocol spoofing, VPNs... yeah, good luck with that.
Re: (Score:2)
We started seeing exploits of Flash Player (CVE-2015-3105) containing CryptoWall payloads last week. This new one probably has the ability to carry out a very similar payload, but is instead concentrating on backdoor access, potentially for botnet building or data extraction.
disable flash! (Score:5, Insightful)
i said it before [slashdot.org] and i'll say it again.
there are very few reasons to keep flash installed/enabled. if you must have it, use flashblock but chances are you can just disable/remove it completely. if some site still uses flash to play video, leave a complaint in the comments. those that haven't switched to html5 yet will do so soon enough.
if you still have java plugin installed, you better have a good reason because no (sane) sites use that shit.
Re: (Score:2)
Disabling since 2011 and very unhappy with site adoption. At least if the site is popular, its targeted with 3rd party software, like twitch for example.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
You are quite right. Flash is un-fixable. I de-installed and disabled it some months ago because I was finally fed up.
Re: (Score:2)
Click to play will protect you against most exploits, since they usually depend on either a) redirects to random malware page or b) infecting ad banners. Sadly there's a lot of decent content built on last decade's technology. And some that are adopting that tech today, but I can't really say more....
Re: (Score:2)
Re: (Score:2)
On my system, it is.
Re: (Score:2)
Except for work computers, which almost always require at least one annoying thing per year which needs Flash ... I've had Flash disabled or simply not installed for as long as there has existed Flash.
Because it's been a horribly broken security hole since it has existed.
My solution to broken videos that require Flash? I simply don't give a damn.
I'm sure there are things people feel they can't live without that require Flash ... for me, I have yet to find a single one.
After over a decade of simply not usin
Re: (Score:2)
I finally removed Flash two weeks ago. Even with white-listing and Flashblock/Click-to-Enable, the few video sites and online apps that use it weren't worth the continued risk of having it installed. Occasionally I run across a site that requires Flash, but these are rare enough that I can skip by the site without too much worry (if I really /really/ need to access a Flash-enabled site, I'll just fire up a virtual image and install Flash on that).
Only downside is that controls for HTML5-video aren't quite
Re: (Score:2)
As long as he's getting paid well, why should he change? (Unless something better comes along of course.) This isn't his personal computer, it's his work computer. If you have shitty software on your work PC and it causes problems, who cares; just call IT, and when your manager complains about slipped schedules you can blame the crapware and IT.
For personal stuff though, you can't blame others when flash fucks up your PC. So he should find another bank.
not another one. FUCK! (Score:1, Insightful)
Re: (Score:2)
Fuck. Another goddamn Adobe update? Fuck Adobe updates.
Are you new to Adobe, Windows, or just computers in general?
Dunno how the hell you're gonna survive the future when your fucking toilet is gonna need a weekly update to avoid those shitty vulns.
Yeah, yeah, yeah...I know it's just a smart toilet. It was in the EULA. Right there on page 743. You should learn to read those things.
Re: (Score:3)
The issue is that Flash's functionality hasn't changed in years, but it needs a security update every other week. You'd think that Adobe could've have sorted that all out by now. If this is the quality of a simple playback plug-in, what conclusion can be drawn about the quality of the rest of their software.
Adobe Acrobat Reader v5 was about 15MB in total size after installation.
Adobe Acrobat Reader v11 is over 400MB in total size after installation.
I really don't think there's any question as to the quality of their shitty bloatware.
In fact, one could argue the main functionality that Adobe has brought to the desktop and browser in the last 10 years is plenty of attack vectors.
And all this bloatware bundling bullshit won't go away until we start holding vendors accountable for the vulnerabilities they create.
Re: (Score:1)
Re: (Score:2)
You may be joking, but now I'm really wondering if toilets in Japan can have their firmware updated, etc.
Re: (Score:2)
Re: (Score:3)
Oh it gets better. Since the last release, they now force mcafee on you. [imgur.com]
Re: (Score:2)
If only Flash had been implemented in a safer programming language, like Pascal, these bugs would've been rare and few. But all the macho programmers love C/C++, so more vulnerabilities and updates for you every day.
Simpler fix: uninstall (Score:2, Insightful)
Youtube uses HTML5 now. Why does anyone still have a reason to use flash? (I mean besides for watching pr0n, which you do inside a virtual machine, and you restore to a checkpoint afterwards to completely avoid any possibility of malware infestation or cross-session cookies, right?)
tl;dr: Uninstall flash. You don't need it anymore.
vmware vsphere is still flash based (Score:1)
vmware vsphere is still flash based
Re: (Score:2)
Even worse - no more C-based fat client from which to avoid using Flash.
Re: (Score:2)
You can get porn over HTML5.
But Hulu and Netfllix both still require 3rd party plugins (Flash, Silverlight)... if I recall correctly.
Re: (Score:1)
Re:Simpler fix: uninstall (Score:4, Informative)
Youtube uses HTML5 now. Why does anyone still have a reason to use flash?
Most functionally useful weather radars, including NOAA's, require Flash. My state's Department of Transportation uses Flash for their traffic cameras. Livestream.com, which hosts my local TV news broadcasts along with other stuff like SpaceX launches, is still Flash. And if I want to view any cable TV programming on the computer, Comcast's player is Flash based.
I'd love to have uninstalled Flash a long time ago; for the time being I have to keep it around and use Flashblock.
Re: (Score:2)
Except for some youtube embeds - they still require flash to use. I have to enable flash for pages pretty regularly.
The unwashed masses (Score:1)
Ok, I'm confused. (Score:2)
Fortunately, I do not need to care (Score:3)
I have de-installed the "Flash" malware some time ago and it will _not_ find its way on my computer again. This thing is a solution for nothing, but a persistent problem. It really is a pity, Adobe used to make good software. Not anymore.
Nuremburg 2.0 (Score:2)
Hmm. Maybe not, as it will probably be broadcast using Flash.
APT3 (Score:2)
If they were a female hacker group, they should haven take the name APT3-G [wikipedia.org]. That would have made the "Clandestine Fox" attack even more deliciously-named.
Why can't it auto-update? (Score:2)
Drives me nuts ever week or so asking me to install updates. It's a stupid pop-up updated app that gets triggered when a page with flash is loaded.
Yes I understand that running a browser non-stop for weeks goes against their updating philosophy. Too bad. The constant "Update now!" alerts just make their users more likely to fall for phishing scams.
Instead, if you can't update your plugin on already loaded pages... Refactor your app.
Make the bit loaded by the browser a wrapper that can allow its back end to
Re: (Score:2)
update now, reboot.. FTFY
Plugin check page broken (Score:2)
Mozilla couldn't run a piss-up in a brewery these days, I went to the plugin check page and it is broken, no plugin check, no link to adobe.
People are going to use it (Score:2)