Vulnerabilities / Threats

04:35 PM
Connect Directly

By Renaming Flash Professional, Adobe Does Little To Alleviate Security Concerns

More than a rebranding, what is really needed is an end to Flash, say some security analysts.

In giving Flash Professional CC a new name this week, Adobe only appears to have prompted fresh questions on when exactly the company plans on phasing out the notoriously buggy technology entirely, instead of just trying to distance itself from it.

Adobe on Monday announced that Animate CC would be the new name for Flash Professional CC.  Animate will become available early next year and will serve as Adobe’s primary animation tool for developing HTML5 content, the company said. The company will also release a video player based on HTML5 for desktop browsers to complement its support for the technology on mobile browsers.

Adobe described the rebranding as part of a broader effort by the company to move to new standards like HTML5 for running animations, multimedia, and video in web browsers. Standards like HTML5 have matured to a point where they provide many of the capabilities that Flash does and customers have said they would like Adobe to adopt such standards, the company noted.

According to Adobe, the rebranding is necessary because they have completely rewritten Flash Professional over the past several years and the product now integrates native HTML5 and support for WebGL. Over one-third of the content created in Flash Professional already is based on HTML5 rather than the Flash format and the name change reflects that evolution, the company said.

Looking ahead, Adobe wants content creators to build apps using the new standards, while the company will focus on supplying tools and services around them. At the same time though, Adobe’s commitment to the creation of new Flash content will continue. “Moving forward, Adobe is committed to working with industry partners, as we have with Microsoft and Google, to help ensure the ongoing compatibility and security of Flash content,” the company said.

Facebook, which earlier this year famously called on Adobe to announce an end-of-life date for Flash, has agreed to work with the Adobe instead. According to Adobe, the two companies will work together to ensure that Flash gaming applications run securely on Facebook. “As part of this cooperation, Facebook will report security information that helps Adobe improve the Flash Player,” Adobe said.

Adobe’s decision to give Flash Professional a new name may well be an attempt to distance itself from a technology that has the unenviable reputation of being among the most vulnerable ever. But it has done little to assuage growing concerns over the security threats posed to users by Flash technology.

“A buggy app is still a buggy app by any other name,” says Richard Stiennon, chief research analyst at IT-Harvest.

Over 50 of 317 yet-to-be-published security advisories involving vulnerabilities discovered by researchers at Tipping Point’s Zero-Day Initiative involve Adobe.

And that’s just the tip of the iceberg. A report released this week by Flexera Software shows that Microsoft ended up as the vendor with the most vulnerable products over the last three months largely because many of the products came bundled with buggy versions of Adobe Flash. Another recent report by Recorded Future showed that eight of the top 10 vulnerabilities used by exploit kit makers in 2015 were in Adobe Flash Player.

The sheer number of recently discovered bugs in Adobe Flash Player and its popularity among exploit kit makers and APT groups such as Pawn Storm raise questions about Flash’s role in a secure environment, Recorded Future had noted.

In that context, it’s possible to see why Adobe may have chosen to rebrand the product, says Scott Donnelly, director of presales at Recorded Future. “It’s a smart branding move for Adobe, due to the heavy associations Recorded Future sees between exploit kits and Flash,” he says. 

“However, based on multiple sources from the web, the product’s security posture remains unchanged for the millions of people who use Flash on a daily basis,” Donnelly says.

So far at least, Adobe has said nothing to indicate that Animate CC will be a major security upgrade over Flash Professional, says John Pescatore, director of emerging security trends at the SANS Institute. “They do seem to be trying to encourage HTML5 output, which is a good thing, but rather than see more features I would have preferred first hearing about a gigantic and deep security push,” Pescatore says.

Users should try to move away from Flash where possible, he says. “Personally, I think the cold turkey approach would be the best way to go. I think users would get over the lack of Flash within a week, if not faster,” he says.

But neither Pescatore nor Stiennon expect to see Flash go away anytime soon.

“Flash is going to be around at least as long as Windows XP,” Stiennon says. “There are too may legacy sites that continue to use it.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
12/4/2015 | 6:49:32 AM
Real Study
what really needs to be studied is: how does attack code manage to jump from an adobe stream and become executable on the victim?     either as user mode or into kernel mode .    this is the door that must be closed: an application program must not be able to compromise its host os
8 Ways Hackers Monetize Stolen Data
Steve Zurier, Freelance Writer,  4/17/2018
Securing Social Media: National Safety, Privacy Concerns
Kelly Sheridan, Staff Editor, Dark Reading,  4/19/2018
Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training
Sara Peters, Senior Editor at Dark Reading,  4/19/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.