Vulnerabilities / Threats

7/26/2017
04:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe's Move to Kill Flash Is Good for Security

In recent years, Flash became one of the buggiest widely used apps out there.

Adobe this week announced plans to finally kill off its Flash media player by the end of 2020, citing obsolescence as one of the primary drivers for its decision. But the reason many want to see the end of the product is security.

For over two decades, Adobe Flash has powered video and interactive content on the Web, especially in areas such as gaming, education, and advertising. But in the past few years, it also became one of the buggiest apps out there.  

Statistics maintained by Mitre show that in 2016 alone a total of 266 vulnerabilities were disclosed in Flash Player, a vast majority of them critical, remotely executable flaws and denial-of-service flaws.

Despite widespread concern over security issues, the number of vulnerabilities in Flash Player actually increased in recent years instead of trending down. In fact, more than half of all vulnerabilities in Flash since 2005 — or 652 vulnerabilities out of 1,030 — were disclosed in just the last three years.

Many of the flaws in Flash have enabled widespread attacks against users running Windows, Chrome, and other platforms. In 2015, Flash accounted for some 17% of all zero-day vulnerabilities discovered that year. Four of the five most exploited zero days in 2015 were in Flash.

Eight of the top 10 security flaws leveraged by exploit kit makers in 2015 were in Flash, according to Recorded Future.

"Flash had the most vulnerabilities of any application — not operating systems — in 2016, and that is after years of Adobe 'fixing' Flash," says John Pescatore, director of emerging security threats at the SANS Institute. So the company's decision to pull the plug on the product is a good one, he says.

"To me, Flash was pretty much just built on a rotted foundation. No amount of added plywood or new shingles was ever going to make it structurally sound or anywhere near safe."

As far back as 2010, Apple's Steve Jobs cited Flash's relative lack of security as one of multiple reasons why Apple would not pre-install the technology on iPhones, iPads, and iPods.

In recent years, all major browser makers — including Google, Apple, Microsoft, and Mozilla — have announced plans to gradually phase out support for the technology. Browsers such as Safari and Microsoft Edge already require users' explicit permission to run the Flash plugin on websites instead of allowing it to run by default. Google has said it will do the same with Chrome soon.

Adobe itself portrayed its decision to end-of-life Flash as being driven by technology trends. In an alert Tuesday, Adobe said technologies such as HTML5, WebGL, and WebAssembly have matured to a point where they have become viable alternatives to Flash for multimedia content on the Web.

Most browser makers have begun integrating capabilities directly into their browsers that were once available only via plugins like Flash. Given this progression, Adobe has decided to terminate support for Flash at the end of 2020, the company said.

Microsoft, Google, and Apple issued simultaneous alerts endorsing the move while reminding users of previously announced plans for phasing out support for Flash in each of their products soon.

Facebook, a platform for which many developers have built Flash-powered games, noted how the evolution of WebGL and HTML5 standards had almost made Flash obsolete, and it urged developers to follow the deadlines set by browser makers. Games built on Flash will continue to run through the end of 2020, but developers should make plans for migrating to other technologies soon, the company noted.

"Adobe Flash has been heavily leveraged in advertising, media, and e-learning spaces," says Mark Butler, CISO of Qualys. "But unfortunately, Adobe has not kept pace with the necessary security updates in order to outweigh the benefits of using the product."

Organizations that rely on Flash should consider moving to HTML5 quickly as it meets the functional needs that Flash previously met. Unlike Flash, HTML5 doesn't require any plugins and allows for seamless inclusion of audio and video files into code, he says. HTML5 is also an open technology that all new browsers have begun to incorporate.

"Security best practice dictates removal or maintaining current patch levels of Adobe's Flash and Java software versions," he said.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NeilB915
50%
50%
NeilB915,
User Rank: Apprentice
9/26/2018 | 3:28:12 AM
Re: Good news indeed
Thnaks for updating this relevant information about Adobe's Move to Kill Flash. As we know that Flash is used by millions of website & the majority of computer in the world have flash installed. Nowadays, Adobe Flash become one of the biggest threats for computer Security. If anyone still having any doubt then i suggest you to contact with Adobe Phone Number to clear your doubt.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/27/2017 | 8:34:57 AM
Good news indeed
Flash is one of the worst doors for malware and cyber-intrusion EVER - that and JAVA.  Getting rid of Flash would be a big benefit going forward, getting Flash OFF the gazillion systems it is installed on is harder.  Now, if we can start coming up with something better than JAVA???
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
Good Times in Security Come When You Least Expect Them
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  10/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.