Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
7/14/2015
10:55 AM
Rees Johnson
Rees Johnson
Partner Perspectives
50%
50%

Are Criminals Quicker Than The Flash?

Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Flash is everywhere. Not the DC Comics superhero with impossible speed, but the Adobe multimedia and software platform that is ubiquitous in our digital lives. While criminals hate the superhero Flash, they appear to love the Adobe one. Why? Because it is installed on so many devices, has many known and unpatched vulnerabilities, and the resulting exploits can be difficult to catch. As a result, the number of Adobe Flash malware samples has increased fourfold from Q4 2014 to Q1 2015. Some of this growth can be attributed to off-the-shelf exploit kits such as Angler that make it easy to deliver malicious payloads through Flash Player.

Adobe started a vulnerability disclosure program last year to address the vulnerabilities discovered in Flash and other Web applications. The best defense against these exploits is automatic installation of Flash patches. These are usually distributed the same day that a vulnerability is submitted, so the window of risk is small for systems that are regularly updated.

Another effective defense is blocking Flash files with .swf extensions from coming through Web gateways, email gateways, and other forms of file transfer within your organization. At the very least, companies should educate their users to use extreme caution when opening files of this type.

Unfortunately, one of the successful attack vectors for Flash is malicious advertisements on legitimate websites. The prevalence of legitimate Flash content makes it difficult or impossible to block all .swf files at the endpoint, so other defenses are necessary to detect and protect against zero-day Flash exploits or older exploits if your systems are not updated frequently enough.

The Evasive Nature Of Malware

Flash exploits are evading traditional signature-based malware detection, as well as more advanced malicious code analysis. They do this by taking advantage of the scripting functionality of Web browsers, the same functionality that makes Web applications so powerful and user-friendly. Malicious scripts dynamically change their code during execution, hide other parts within the HTML document, and then execute the necessary code to exploit the appropriate vulnerability. Detecting these attacks requires emulation of the script and the browser in order to observe and block the malicious behavior.

Using a Web gateway with full browser emulation, the malicious script is allowed to assemble and execute in captivity. If it exhibits malicious behavior, then it is convicted and blocked. Information about the malicious script or file can then be quickly shared with cloud intelligence to further restrict the spread of the attack, allowing other devices to immediately block the same threat.

As Web exploits advance, so does the security technology built to handle them. Port-level redirection to a Web gateway can remove the limitations of browser compatibility, looking at traffic from all browsers and even applications. Cloud-based Web gateways remove the limitations of network boundaries, allowing you to protect users in any location by redirecting traffic to the closest protection center.  

The Internet provides tremendous benefits to our organizations. When it comes with vulnerabilities, the technology is available to detect malicious behavior and protect your organization. Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Rees Johnson is Senior Vice President and General Manager of the Content Security Business Unit at Intel Security, which includes Web Security, Email Security, and Data Loss Prevention technology.  Rees and his team are in charge of securing the most utilized vectors of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8813
PUBLISHED: 2020-02-22
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
CVE-2020-9039
PUBLISHED: 2020-02-22
Couchbase Server 4.x and 5.x before 6.0.0 has Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).
CVE-2020-8860
PUBLISHED: 2020-02-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. T...
CVE-2020-8861
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue ...
CVE-2020-8862
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the ...