Adobe Flash Responsible For Six of the Top 10 Bugs Used By Exploit Kits In 2016 (onthewire.io) 72
Trailrunner7 quotes a report from On the Wire: Vulnerabilities in Flash and Internet Explorer dominated the exploit kit landscape in the last year, with a high-profile bug in Flash being found in seven separate kits, new research shows. Exploit kits have long been a key tool in the arsenal of many attackers, from low-level gangs to highly organized cybercrime crews. Their attraction stems from their ease of use and the ability for attackers to add exploits for new vulnerabilities as needed. While there are dozens of exploit kits available, a handful of them attract the most use and attention, including Angler, Neutrino, Nuclear, and Rig. Researchers at Recorded Future looked at more than 140 exploit kits and analyzed which exploits appeared in the most kits in the last year, and it's no surprise that Flash and IE exploits dominated the landscape. Six of the top 10 most-refquently targeted vulnerabilities in the last year were in Flash, while the other four were in Microsoft products, including IE, Windows, and Silverlight. Flash has been a favorite target for attackers for a long time, for two main reasons: it's deployed on hundreds of millions of machines, and it has plenty of vulnerabilities. Recorded Future's analysis shows that trend is continuing, and one Flash bug disclosed October 2015 was incorporated into seven individual exploit kits. The flaw was used by a number of high-level attackers, including some APT groups. "Adobe Flash Player's CVE-2015-7645, number 10 in terms of references to exploit kits, stands out as the vulnerability with the most adoption by exploit kits. Exploit kits adopting the Adobe bug in the past year include Neutrino, Angler, Magnitude, RIG, Nuclear Pack, Spartan, and Hunter," the analysis by Recorded Future says.
Official statement from Adobe: (Score:5, Funny)
We're proud to have 6/10 of the top bugs and will work hard to have even more in the top 10 next year.
Re: (Score:2, Funny)
IE is slipping - only 4/10 top bugs. Heads will roll in Redmond!
Re: (Score:3)
Re: (Score:3, Insightful)
It is only hard to understand by people like you because you think that a bug is the same as a vulnerability. Guess what?? THEY AREN'T THE SAME THING.
You can have millions of bugs and the application can be without a single vulnerability.
Also, not all vulnerabilities are equal. Anything that requires physical access to the device is low on the vulnerability scale, while something that only requires somebody to visit a web-page is HIGH and dangerous.
Re: (Score:1)
Re: (Score:1)
It is only hard to understand for people like you that walk around with your eyes shut. Firefox has been shit security wise for some time now, go check out firefox vulnerability list for the last 2 years and how often they have had exploitable holes that require no user interaction beyond browsing to a malicious site.
Re: (Score:2)
A bug is only an unexploited vulnerability...
Re:Official statement from Adobe: (Score:5, Informative)
Flash gets targeted because its a monoculture, 95% of potential victims are running the same flash plugin with the same vulnerabilities, there aren't really any alternative flash plugins.
Targeting the browser is less effective these days as there are several major browsers and your potential victims could be using any of them.
Targeting IE instead of Firefox is still more effective as its a default install. Anyone running Firefox has generally gone out of their way to install it and is more likely to keep it up to date, users running IE are generally doing so just because it's there and are likely to be less tech savvy.
Back when IE had 95% of the browser market it was the obvious target.
Re: (Score:2)
On the flip side, at least you get to see animated ads and Farmville!
Why is this the case? (Score:5, Insightful)
Is there something instrinsic about the functions that Adode Flash does that makes this inevitable or is it that Adobe started with an unfixable design model or is it that Adobe is incompetent. Offhand I don't see a fourth option. Well maybe just bad luck.
SO for example. In the first option, we can compare the functionality of adobe to other systems. Silver light or H264 is not the same thing since unless I'm mistaken Adobe flash is not just a codec but also a language. So a better point of comparison is Java. If it's a matter of functionality leading to intrinsic vulnerabilities in a browser setting then one would expect Java and Flash to have the same frequency of exploits. Perhaps what saves Java is that it's usually off by default and asks permission to run.
Alternatively if it's an unfixable design model, I don't see a dimes worth of difference between this an incompetence except that the former is worse because one knows the design was incompetent but persists in selling it. It's like the difference between premeditated murder and manslaughter..
So given they could eliminate most expoits why don't all browsers quarantine Adobe or classify it as suspect malware.
Re: (Score:2)
SO for example. In the first option, we can compare the functionality of adobe to other systems. Silver light or H264 is not the same thing since unless I'm mistaken Adobe flash is not just a codec but also a language.
Silverlight is just a SDK, and a plugin which lets you use stuff in windows from inside the browser so as to enable development of applications with web interfaces (defined in XAML) in Visual Studio. The things that it provides which aren't necessarily provided by the browser already (besides vector graphics and animations) are "H.264 video, Advanced Audio Coding, Windows Media Video (WMV), Windows Media Audio (WMA), and MPEG Layer III (MP3)". [wp [wikipedia.org]] Thus, it's really more like Flash than H.264, although it's
Re: (Score:2)
Okay so if it has the same range of native functionality then why isn't it a vector for exploits to the same degree?
Re: (Score:1)
Okay so if it has the same range of native functionality then why isn't it a vector for exploits to the same degree?
There are probably two reasons. Reason the first, Adobe has always been legendarily bad at security, worse than even Microsoft. Reason the second, Silverlight apps don't actually run in your browser. They run on the server. Only the presentation occurs in your browser. That means they're not adding another scripting language to your browser, either. Any scripting that happens in your browser related to a Silverlight app is using the existing script host.
Re: (Score:2)
Complete and total BS. Silverlight runs code in the browser on the client machine. It's only hosted on the server. It's just like Flash in that respect.
Re: (Score:2)
There are plenty of silverlight vulnerabilities, but the silverlight plugin is not as widespread as flash so there's far less incentive for anyone to attack it.
Re:Why is this the case? (Score:5, Interesting)
Flash is a pileup of every problem you mention and more. A vector animation plugin had a scripting language (ActionScript) tacked on top of it, and there are multiple versions of this language, each with its own legacy bugs, and newer versions of the plugin support older versions of ActionScript (so that old Flash files won't break). When I coded in it circa 2003, ActionScript was incredibly buggy, with many functions malfunctioning or being completely broken; it's safe to say that few to no parameters were being sanity-checked or sanitized. It was created in the ActiveX era where "rush it out the door before the competitors can" was at the top of the priority list, and anyone expressing concern for security was handed a pink slip and laughed out the door. New features were being added all the time at top speed and who has time to make it secure?
By the time ActiveX got tamped down on in the XP SP2 days, it became more clear how bad Flash (and Java) was in the security department, but I imagine many of the original coders had left, likely with little to no code documentation so it was effectively unmaintainable. Putting out fires of perceived insecurity by fixing publicly found vulnerabilities was the actual security goal then, with little proactive finding of vulnerabilities. Macromedia only made money from their Flash authoring software, not the plugin itself, and there were eventually free/cheaper programs that let you create or at least maintain Flash content, so the money for securing the plugin was never there.
Thankfully Chrome is leading the charge in killing it off for good. Nearly everything it does is done better (and more securely) by another technology now.
You got the wrong guy (Score:1, Flamebait)
The operating system is responsible for all of the bugs.
Re: (Score:1)
I don't know. Does Adobe flash run on Linux? I've always used Chrome or VLC when I need to play Flash content.
Re: (Score:1)
Re: (Score:1)
The operating system is responsible for all of the bugs.
no, it's electricity that's responsible for all the bugs, stop the flow of electricity and the bugs will also stop
More holes than swiss cheese (Score:2, Insightful)
How can *one* piece of software have so many fucking critical vulnerabilities over the years? Seriously, Flash has had new exploits just about every month, going back 10 years or more. There comes a point where the opposite of Hanlon's razor becomes likely; this simply can't be incompetence anymore, it must be malice. Is the NSA running the show at Adobe or something?
Re:More holes than swiss cheese (Score:5, Informative)
>How can *one* piece of software have so many fucking critical vulnerabilities over the years?
Because it's spaghetti code. It's so bad that the single Linux maintainer flipped his shit years ago and wrote an angry blog post about it. I tried looking for the article, but that is too much of a needle/haystack problem.
Apparently it's been a fucking mess from the beginning.
--
BMO
Re: (Score:3)
Re: (Score:3)
OK, so I'm an amateur, and I don't know squat, but even I know you don't ever run Adobe Flash for any reason on your browser. And if you really really feel the need to run Adobe Flash, you do it in a throwaway browser that you only use to run Adobe Flash. So is this really news.
You don't know squat about knowing squat. People who don't know squat aren't even able to tell that "you are infected click here to fix" is just a web banner and not an actual dialog box, much less what a browser or a plug-in or flash is. I'll also give you the Star Trek universal translation matrix, whenever people like that are asked "Do you want to flubber the gavot on the pinoshi? [Yes][No]" or anything else incomprehensible it translates to "You want this to work? [Yes][No]" and they click yes yes yes.
User Skills (Score:2)
This article shows how wide the skills gap really is. [nngroup.com] By Slashdot standards, the vast majority of computer users are tech-illiterate. What we take for granted -- for example, knowing anything about Flash security -- is completely beyond them. The linked article also fixes this divide as the reason UI is hard: if you are capable of making one, you are ipso facto not able to judge the needs of the average user. My perspective on this has always been that some of humanity has to sacrifice our brains to this te
Re: (Score:1)
Re:More holes than swiss cheese (Score:4, Informative)
Adobe's contribution to computing began and ended with Postscript. I'll also give some credit for the pdf format/concept itself, despite obvious flaws in the implementation. Photoshop is a convoluted mess which is successful in spite of its faults, purely due to inertia and lack of competition. All else they've ever created simply sucks.
I'd believe the spaghetti code explanation, but that's a rationalization, not an excuse.
That's still just postscript (zipped) (Score:5, Interesting)
You give them credit for Postscript and for pdf. Pdf is essentially Postscript, zipped, with some of the code commented out. So really they deserve credit just for Postscript.
Except that postscript was largely created at Xerox PARC, before John Warnock and Chuck Geschke left. Warnock and Geschke wanted Xerox to sell Postscript (then called Interpress) as a standalone product, but Xerox chose not to. So the two left and created Adobe to sell Xerox's idea.
So anyway their one great thing, Postscript, wasn't created by Adobe.
In the days when cross-browser Javascript/Actionscript was darn near impossible, Adobe Flash was *conceptually* a good idea - a plugin that carried the same dialect of JavaScript/Emacscript to every browser. Unfortunately they really, really suck at security.
Re: (Score:2)
Adobe didn't create Flash either. It was created by Macromedia, who was bought by Adobe.
Re:That's still just postscript (zipped) (Score:5, Informative)
Re: (Score:2)
Thank you for subscribing to Human Facts!
Did you know? A human female is born with all the eggs she'll ever have during her lifetime [columbia.edu]. That means that you, dear AC, were technically halfway into the world while your mother was still in your grandmother's womb!
Stay tuned for tomorrow's installment of Human Facts, "Why Natalie Portman may calcify but won't ever petrify."
Re: (Score:3)
Moreover, it's incredibly complex code that performs real-time media playback, animation, and scripting. Essentially, it's got all the vulnerabilities of a complex media player (like the Stagefright library) combined with a scripting language runtime environment (like Javascript), all written in a language (C) that more or less hands an attacker a potential security vulnerabilities if a programmer made the tiniest of errors when handling memory buffers and file formats with deliberately malformed data, and
Re: (Score:1)
what is a REWRITE
Competition (Score:3)
It's just a friendly competition is all. The Adobe Flash team has a lot of work ahead of them still to catch up to Adobe Reader as the all-time champion of browser-based attack vectors. However they're giving it their best shot.
I know how to make Flash less dangerous (Score:2)
We could make it even more annoying than it is now. Rather than just having to be updated every time you use it, the model that Windows users are familiar with when they run Adobe Reader, make it update two or three times during the playing of each video. Websites will have to stop using it.
Open Warfare...on exploits. (Score:2)
So has anyone written an open source version of the Flash browser plug-in?
Re: (Score:1)
There is one, called gnash [gnu.org]. It's no longer active.
As Samuel L. Jackson said ... (Score:1)
only 6? (Score:1)
Not news to me (Score:2)
I have stated in the past what an utter disaster Java and Flash are, and have been pounded for my opinion. So be it.
Does it apply for Flash in Chrome/Chromium? (Score:2)