Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
7/14/2015
10:55 AM
Rees Johnson
Rees Johnson
Partner Perspectives
50%
50%

Are Criminals Quicker Than The Flash?

Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Flash is everywhere. Not the DC Comics superhero with impossible speed, but the Adobe multimedia and software platform that is ubiquitous in our digital lives. While criminals hate the superhero Flash, they appear to love the Adobe one. Why? Because it is installed on so many devices, has many known and unpatched vulnerabilities, and the resulting exploits can be difficult to catch. As a result, the number of Adobe Flash malware samples has increased fourfold from Q4 2014 to Q1 2015. Some of this growth can be attributed to off-the-shelf exploit kits such as Angler that make it easy to deliver malicious payloads through Flash Player.

Adobe started a vulnerability disclosure program last year to address the vulnerabilities discovered in Flash and other Web applications. The best defense against these exploits is automatic installation of Flash patches. These are usually distributed the same day that a vulnerability is submitted, so the window of risk is small for systems that are regularly updated.

Another effective defense is blocking Flash files with .swf extensions from coming through Web gateways, email gateways, and other forms of file transfer within your organization. At the very least, companies should educate their users to use extreme caution when opening files of this type.

Unfortunately, one of the successful attack vectors for Flash is malicious advertisements on legitimate websites. The prevalence of legitimate Flash content makes it difficult or impossible to block all .swf files at the endpoint, so other defenses are necessary to detect and protect against zero-day Flash exploits or older exploits if your systems are not updated frequently enough.

The Evasive Nature Of Malware

Flash exploits are evading traditional signature-based malware detection, as well as more advanced malicious code analysis. They do this by taking advantage of the scripting functionality of Web browsers, the same functionality that makes Web applications so powerful and user-friendly. Malicious scripts dynamically change their code during execution, hide other parts within the HTML document, and then execute the necessary code to exploit the appropriate vulnerability. Detecting these attacks requires emulation of the script and the browser in order to observe and block the malicious behavior.

Using a Web gateway with full browser emulation, the malicious script is allowed to assemble and execute in captivity. If it exhibits malicious behavior, then it is convicted and blocked. Information about the malicious script or file can then be quickly shared with cloud intelligence to further restrict the spread of the attack, allowing other devices to immediately block the same threat.

As Web exploits advance, so does the security technology built to handle them. Port-level redirection to a Web gateway can remove the limitations of browser compatibility, looking at traffic from all browsers and even applications. Cloud-based Web gateways remove the limitations of network boundaries, allowing you to protect users in any location by redirecting traffic to the closest protection center.  

The Internet provides tremendous benefits to our organizations. When it comes with vulnerabilities, the technology is available to detect malicious behavior and protect your organization. Using the right technology, we can defeat the malicious exploitation of Flash and return it to its full superhero status.

Rees Johnson is Senior Vice President and General Manager of the Content Security Business Unit at Intel Security, which includes Web Security, Email Security, and Data Loss Prevention technology.  Rees and his team are in charge of securing the most utilized vectors of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16669
PUBLISHED: 2019-09-21
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
CVE-2019-16656
PUBLISHED: 2019-09-21
joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.
CVE-2019-16657
PUBLISHED: 2019-09-21
TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
CVE-2019-16658
PUBLISHED: 2019-09-21
TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
CVE-2019-16659
PUBLISHED: 2019-09-21
TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.