Less than five weeks into the new year, 2015 is already shaping up as one of the most perilous years for users of Adobe Flash, with active exploits against three separate zero-day vulnerabilities, one of which still wasn't fully patched as this post went live.
The latest attacks are hitting unsuspecting targets through drive-by downloads served through ads on dailymotion.com, theblaze.com, nydailynews.com, tagged.com, webmail.earthlink.net, and other sites, according to research from Malwarebytes. And while the vulnerability wasn't disclosed until this week, the exploits have been active and in the wild since December 3, Malwarebytes found.
While the attacks target Windows users running Flash in a Firefox or Internet Explorer browser, the underlying CVE-2015-0313 security bug is present in Flash for Macs and Linux machines as well. On late Wednesday, Adobe began distributing a fix to users who have opted to receive automatic updates. In the meantime, readers should consider disabling Flash altogether, or at the very least, using Flash inside Google Chrome, the browser many security experts say provides the most comprehensive anti-exploit protections. Attacks exploiting CVE-2015-0313 are unable to escape the Chrome security sandbox, research from Trend Micro found.Exploit fatigue
The rapid succession of zero-day exploits in such a short period of time is made possible by exploit kits sold in underground forums online. Malware purveyors pay subscription fees and in return get weaponized exploits they can plug into compromised websites or, in some cases, into banner advertisements distributed over ad networks. An exploit kit known as Angler distributed attack code for the first two Flash zerodays. The most recent vulnerability is being exploited by an Angler competitor known as Hanjuan.
The breakneck pace of the exploits is creating fatigue among end users, and one presumes, among engineers inside Adobe. No sooner is one patch rolled out than an exploit targeting a new vulnerability becomes available. What's more, Research from Cisco Systems found the recent Flash exploits were being served on more than 1,800 domains.
The persistence, speed, and abundance are only some of the ingredients underscoring the viciousness of these latest campaigns. Researchers from security firm Invincea found evidence online crooks may be exploiting Flash zerodays to install crypto ransomware on vulnerable computers. Such malware—which encrypts images, documents, and other valuable user data and demands victims pay hundreds of dollars to recover them—has traditionally relied on social engineering ploys that trick people into clicking on malicious files. If unpatched Flash vulnerabilities become a standard way of installing cryptoware, the scourge could become an even bigger problem than it is now, since it could menace much more experienced users.
Anyone who uses Flash—whether on machines running Windows, Mac OS X, or Linux—should ensure they are running the latest version by checking this link. Unfortunately, many Windows users must run the check twice—once using IE and again with Firefox or other non-Chrome browsers. At the time this post was being prepared, the latest version, 16.0.0.305, is available only to people who have enabled automatic updates. Adobe doesn't expect to have manual updates available until Thursday.
As the Flash-targeting threats grow more hostile, rapid patching may not be enough. Instead, readers should consider uninstalling Flash altogether, or possibly using one browser for a handful of indispensable sites that require the Adobe plugin and a separate, non-Flash-using browser for everything else. As already mentioned in this post, Chrome is widely regarded as the safest browser for viewing Flash content. An alternative is to configure Chrome to disable the plugin on all but a select number of sites. No doubt, removing a plugin that most sites depend on is a burden and not in the spirit of openness, but it may make sense for many users given the troubling series of events in recent weeks.
reader comments
194