Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
7/14/2015
10:55 AM
Rees Johnson
Rees Johnson
Partner Perspectives
50%
50%

Are Criminals Quicker Than The Flash?

Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Flash is everywhere. Not the DC Comics superhero with impossible speed, but the Adobe multimedia and software platform that is ubiquitous in our digital lives. While criminals hate the superhero Flash, they appear to love the Adobe one. Why? Because it is installed on so many devices, has many known and unpatched vulnerabilities, and the resulting exploits can be difficult to catch. As a result, the number of Adobe Flash malware samples has increased fourfold from Q4 2014 to Q1 2015. Some of this growth can be attributed to off-the-shelf exploit kits such as Angler that make it easy to deliver malicious payloads through Flash Player.

Adobe started a vulnerability disclosure program last year to address the vulnerabilities discovered in Flash and other Web applications. The best defense against these exploits is automatic installation of Flash patches. These are usually distributed the same day that a vulnerability is submitted, so the window of risk is small for systems that are regularly updated.

Another effective defense is blocking Flash files with .swf extensions from coming through Web gateways, email gateways, and other forms of file transfer within your organization. At the very least, companies should educate their users to use extreme caution when opening files of this type.

Unfortunately, one of the successful attack vectors for Flash is malicious advertisements on legitimate websites. The prevalence of legitimate Flash content makes it difficult or impossible to block all .swf files at the endpoint, so other defenses are necessary to detect and protect against zero-day Flash exploits or older exploits if your systems are not updated frequently enough.

The Evasive Nature Of Malware

Flash exploits are evading traditional signature-based malware detection, as well as more advanced malicious code analysis. They do this by taking advantage of the scripting functionality of Web browsers, the same functionality that makes Web applications so powerful and user-friendly. Malicious scripts dynamically change their code during execution, hide other parts within the HTML document, and then execute the necessary code to exploit the appropriate vulnerability. Detecting these attacks requires emulation of the script and the browser in order to observe and block the malicious behavior.

Using a Web gateway with full browser emulation, the malicious script is allowed to assemble and execute in captivity. If it exhibits malicious behavior, then it is convicted and blocked. Information about the malicious script or file can then be quickly shared with cloud intelligence to further restrict the spread of the attack, allowing other devices to immediately block the same threat.

As Web exploits advance, so does the security technology built to handle them. Port-level redirection to a Web gateway can remove the limitations of browser compatibility, looking at traffic from all browsers and even applications. Cloud-based Web gateways remove the limitations of network boundaries, allowing you to protect users in any location by redirecting traffic to the closest protection center.  

The Internet provides tremendous benefits to our organizations. When it comes with vulnerabilities, the technology is available to detect malicious behavior and protect your organization. Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Rees Johnson is Senior Vice President and General Manager of the Content Security Business Unit at Intel Security, which includes Web Security, Email Security, and Data Loss Prevention technology.  Rees and his team are in charge of securing the most utilized vectors of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13552
PUBLISHED: 2019-09-18
In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution.
CVE-2019-15301
PUBLISHED: 2019-09-18
A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value parameter.
CVE-2019-5042
PUBLISHED: 2019-09-18
An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free. An attacker can send a malicious PDF to trigger this vulnerability.
CVE-2019-5066
PUBLISHED: 2019-09-18
An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free condition. To trigger this vulnerability, a specifically crafted PDF document needs ...
CVE-2019-5067
PUBLISHED: 2019-09-18
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory, resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerabi...