Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
7/14/2015
10:55 AM
Rees Johnson
Rees Johnson
Partner Perspectives
50%
50%

Are Criminals Quicker Than The Flash?

Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Flash is everywhere. Not the DC Comics superhero with impossible speed, but the Adobe multimedia and software platform that is ubiquitous in our digital lives. While criminals hate the superhero Flash, they appear to love the Adobe one. Why? Because it is installed on so many devices, has many known and unpatched vulnerabilities, and the resulting exploits can be difficult to catch. As a result, the number of Adobe Flash malware samples has increased fourfold from Q4 2014 to Q1 2015. Some of this growth can be attributed to off-the-shelf exploit kits such as Angler that make it easy to deliver malicious payloads through Flash Player.

Adobe started a vulnerability disclosure program last year to address the vulnerabilities discovered in Flash and other Web applications. The best defense against these exploits is automatic installation of Flash patches. These are usually distributed the same day that a vulnerability is submitted, so the window of risk is small for systems that are regularly updated.

Another effective defense is blocking Flash files with .swf extensions from coming through Web gateways, email gateways, and other forms of file transfer within your organization. At the very least, companies should educate their users to use extreme caution when opening files of this type.

Unfortunately, one of the successful attack vectors for Flash is malicious advertisements on legitimate websites. The prevalence of legitimate Flash content makes it difficult or impossible to block all .swf files at the endpoint, so other defenses are necessary to detect and protect against zero-day Flash exploits or older exploits if your systems are not updated frequently enough.

The Evasive Nature Of Malware

Flash exploits are evading traditional signature-based malware detection, as well as more advanced malicious code analysis. They do this by taking advantage of the scripting functionality of Web browsers, the same functionality that makes Web applications so powerful and user-friendly. Malicious scripts dynamically change their code during execution, hide other parts within the HTML document, and then execute the necessary code to exploit the appropriate vulnerability. Detecting these attacks requires emulation of the script and the browser in order to observe and block the malicious behavior.

Using a Web gateway with full browser emulation, the malicious script is allowed to assemble and execute in captivity. If it exhibits malicious behavior, then it is convicted and blocked. Information about the malicious script or file can then be quickly shared with cloud intelligence to further restrict the spread of the attack, allowing other devices to immediately block the same threat.

As Web exploits advance, so does the security technology built to handle them. Port-level redirection to a Web gateway can remove the limitations of browser compatibility, looking at traffic from all browsers and even applications. Cloud-based Web gateways remove the limitations of network boundaries, allowing you to protect users in any location by redirecting traffic to the closest protection center.  

The Internet provides tremendous benefits to our organizations. When it comes with vulnerabilities, the technology is available to detect malicious behavior and protect your organization. Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Rees Johnson is Senior Vice President and General Manager of the Content Security Business Unit at Intel Security, which includes Web Security, Email Security, and Data Loss Prevention technology.  Rees and his team are in charge of securing the most utilized vectors of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3738
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-3739
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-3740
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVE-2019-3756
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVE-2019-3758
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts.