Vulnerabilities / Threats

7/26/2017
04:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe's Move to Kill Flash Is Good for Security

In recent years, Flash became one of the buggiest widely used apps out there.

Adobe this week announced plans to finally kill off its Flash media player by the end of 2020, citing obsolescence as one of the primary drivers for its decision. But the reason many want to see the end of the product is security.

For over two decades, Adobe Flash has powered video and interactive content on the Web, especially in areas such as gaming, education, and advertising. But in the past few years, it also became one of the buggiest apps out there.  

Statistics maintained by Mitre show that in 2016 alone a total of 266 vulnerabilities were disclosed in Flash Player, a vast majority of them critical, remotely executable flaws and denial-of-service flaws.

Despite widespread concern over security issues, the number of vulnerabilities in Flash Player actually increased in recent years instead of trending down. In fact, more than half of all vulnerabilities in Flash since 2005 — or 652 vulnerabilities out of 1,030 — were disclosed in just the last three years.

Many of the flaws in Flash have enabled widespread attacks against users running Windows, Chrome, and other platforms. In 2015, Flash accounted for some 17% of all zero-day vulnerabilities discovered that year. Four of the five most exploited zero days in 2015 were in Flash.

Eight of the top 10 security flaws leveraged by exploit kit makers in 2015 were in Flash, according to Recorded Future.

"Flash had the most vulnerabilities of any application — not operating systems — in 2016, and that is after years of Adobe 'fixing' Flash," says John Pescatore, director of emerging security threats at the SANS Institute. So the company's decision to pull the plug on the product is a good one, he says.

"To me, Flash was pretty much just built on a rotted foundation. No amount of added plywood or new shingles was ever going to make it structurally sound or anywhere near safe."

As far back as 2010, Apple's Steve Jobs cited Flash's relative lack of security as one of multiple reasons why Apple would not pre-install the technology on iPhones, iPads, and iPods.

In recent years, all major browser makers — including Google, Apple, Microsoft, and Mozilla — have announced plans to gradually phase out support for the technology. Browsers such as Safari and Microsoft Edge already require users' explicit permission to run the Flash plugin on websites instead of allowing it to run by default. Google has said it will do the same with Chrome soon.

Adobe itself portrayed its decision to end-of-life Flash as being driven by technology trends. In an alert Tuesday, Adobe said technologies such as HTML5, WebGL, and WebAssembly have matured to a point where they have become viable alternatives to Flash for multimedia content on the Web.

Most browser makers have begun integrating capabilities directly into their browsers that were once available only via plugins like Flash. Given this progression, Adobe has decided to terminate support for Flash at the end of 2020, the company said.

Microsoft, Google, and Apple issued simultaneous alerts endorsing the move while reminding users of previously announced plans for phasing out support for Flash in each of their products soon.

Facebook, a platform for which many developers have built Flash-powered games, noted how the evolution of WebGL and HTML5 standards had almost made Flash obsolete, and it urged developers to follow the deadlines set by browser makers. Games built on Flash will continue to run through the end of 2020, but developers should make plans for migrating to other technologies soon, the company noted.

"Adobe Flash has been heavily leveraged in advertising, media, and e-learning spaces," says Mark Butler, CISO of Qualys. "But unfortunately, Adobe has not kept pace with the necessary security updates in order to outweigh the benefits of using the product."

Organizations that rely on Flash should consider moving to HTML5 quickly as it meets the functional needs that Flash previously met. Unlike Flash, HTML5 doesn't require any plugins and allows for seamless inclusion of audio and video files into code, he says. HTML5 is also an open technology that all new browsers have begun to incorporate.

"Security best practice dictates removal or maintaining current patch levels of Adobe's Flash and Java software versions," he said.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NeilB915
50%
50%
NeilB915,
User Rank: Apprentice
9/26/2018 | 3:28:12 AM
Re: Good news indeed
Thnaks for updating this relevant information about Adobe's Move to Kill Flash. As we know that Flash is used by millions of website & the majority of computer in the world have flash installed. Nowadays, Adobe Flash become one of the biggest threats for computer Security. If anyone still having any doubt then i suggest you to contact with Adobe Phone Number to clear your doubt.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/27/2017 | 8:34:57 AM
Good news indeed
Flash is one of the worst doors for malware and cyber-intrusion EVER - that and JAVA.  Getting rid of Flash would be a big benefit going forward, getting Flash OFF the gazillion systems it is installed on is harder.  Now, if we can start coming up with something better than JAVA???
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6487
PUBLISHED: 2019-01-18
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.