Vulnerabilities / Threats
12/3/2015
04:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

By Renaming Flash Professional, Adobe Does Little To Alleviate Security Concerns

More than a rebranding, what is really needed is an end to Flash, say some security analysts.

In giving Flash Professional CC a new name this week, Adobe only appears to have prompted fresh questions on when exactly the company plans on phasing out the notoriously buggy technology entirely, instead of just trying to distance itself from it.

Adobe on Monday announced that Animate CC would be the new name for Flash Professional CC.  Animate will become available early next year and will serve as Adobe’s primary animation tool for developing HTML5 content, the company said. The company will also release a video player based on HTML5 for desktop browsers to complement its support for the technology on mobile browsers.

Adobe described the rebranding as part of a broader effort by the company to move to new standards like HTML5 for running animations, multimedia, and video in web browsers. Standards like HTML5 have matured to a point where they provide many of the capabilities that Flash does and customers have said they would like Adobe to adopt such standards, the company noted.

According to Adobe, the rebranding is necessary because they have completely rewritten Flash Professional over the past several years and the product now integrates native HTML5 and support for WebGL. Over one-third of the content created in Flash Professional already is based on HTML5 rather than the Flash format and the name change reflects that evolution, the company said.

Looking ahead, Adobe wants content creators to build apps using the new standards, while the company will focus on supplying tools and services around them. At the same time though, Adobe’s commitment to the creation of new Flash content will continue. “Moving forward, Adobe is committed to working with industry partners, as we have with Microsoft and Google, to help ensure the ongoing compatibility and security of Flash content,” the company said.

Facebook, which earlier this year famously called on Adobe to announce an end-of-life date for Flash, has agreed to work with the Adobe instead. According to Adobe, the two companies will work together to ensure that Flash gaming applications run securely on Facebook. “As part of this cooperation, Facebook will report security information that helps Adobe improve the Flash Player,” Adobe said.

Adobe’s decision to give Flash Professional a new name may well be an attempt to distance itself from a technology that has the unenviable reputation of being among the most vulnerable ever. But it has done little to assuage growing concerns over the security threats posed to users by Flash technology.

“A buggy app is still a buggy app by any other name,” says Richard Stiennon, chief research analyst at IT-Harvest.

Over 50 of 317 yet-to-be-published security advisories involving vulnerabilities discovered by researchers at Tipping Point’s Zero-Day Initiative involve Adobe.

And that’s just the tip of the iceberg. A report released this week by Flexera Software shows that Microsoft ended up as the vendor with the most vulnerable products over the last three months largely because many of the products came bundled with buggy versions of Adobe Flash. Another recent report by Recorded Future showed that eight of the top 10 vulnerabilities used by exploit kit makers in 2015 were in Adobe Flash Player.

The sheer number of recently discovered bugs in Adobe Flash Player and its popularity among exploit kit makers and APT groups such as Pawn Storm raise questions about Flash’s role in a secure environment, Recorded Future had noted.

In that context, it’s possible to see why Adobe may have chosen to rebrand the product, says Scott Donnelly, director of presales at Recorded Future. “It’s a smart branding move for Adobe, due to the heavy associations Recorded Future sees between exploit kits and Flash,” he says. 

“However, based on multiple sources from the web, the product’s security posture remains unchanged for the millions of people who use Flash on a daily basis,” Donnelly says.

So far at least, Adobe has said nothing to indicate that Animate CC will be a major security upgrade over Flash Professional, says John Pescatore, director of emerging security trends at the SANS Institute. “They do seem to be trying to encourage HTML5 output, which is a good thing, but rather than see more features I would have preferred first hearing about a gigantic and deep security push,” Pescatore says.

Users should try to move away from Flash where possible, he says. “Personally, I think the cold turkey approach would be the best way to go. I think users would get over the lack of Flash within a week, if not faster,” he says.

But neither Pescatore nor Stiennon expect to see Flash go away anytime soon.

“Flash is going to be around at least as long as Windows XP,” Stiennon says. “There are too may legacy sites that continue to use it.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
12/4/2015 | 6:49:32 AM
Real Study
what really needs to be studied is: how does attack code manage to jump from an adobe stream and become executable on the victim?     either as user mode or into kernel mode .    this is the door that must be closed: an application program must not be able to compromise its host os
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.