Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/26/2017
04:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe's Move to Kill Flash Is Good for Security

In recent years, Flash became one of the buggiest widely used apps out there.

Adobe this week announced plans to finally kill off its Flash media player by the end of 2020, citing obsolescence as one of the primary drivers for its decision. But the reason many want to see the end of the product is security.

For over two decades, Adobe Flash has powered video and interactive content on the Web, especially in areas such as gaming, education, and advertising. But in the past few years, it also became one of the buggiest apps out there.  

Statistics maintained by Mitre show that in 2016 alone a total of 266 vulnerabilities were disclosed in Flash Player, a vast majority of them critical, remotely executable flaws and denial-of-service flaws.

Despite widespread concern over security issues, the number of vulnerabilities in Flash Player actually increased in recent years instead of trending down. In fact, more than half of all vulnerabilities in Flash since 2005 — or 652 vulnerabilities out of 1,030 — were disclosed in just the last three years.

Many of the flaws in Flash have enabled widespread attacks against users running Windows, Chrome, and other platforms. In 2015, Flash accounted for some 17% of all zero-day vulnerabilities discovered that year. Four of the five most exploited zero days in 2015 were in Flash.

Eight of the top 10 security flaws leveraged by exploit kit makers in 2015 were in Flash, according to Recorded Future.

"Flash had the most vulnerabilities of any application — not operating systems — in 2016, and that is after years of Adobe 'fixing' Flash," says John Pescatore, director of emerging security threats at the SANS Institute. So the company's decision to pull the plug on the product is a good one, he says.

"To me, Flash was pretty much just built on a rotted foundation. No amount of added plywood or new shingles was ever going to make it structurally sound or anywhere near safe."

As far back as 2010, Apple's Steve Jobs cited Flash's relative lack of security as one of multiple reasons why Apple would not pre-install the technology on iPhones, iPads, and iPods.

In recent years, all major browser makers — including Google, Apple, Microsoft, and Mozilla — have announced plans to gradually phase out support for the technology. Browsers such as Safari and Microsoft Edge already require users' explicit permission to run the Flash plugin on websites instead of allowing it to run by default. Google has said it will do the same with Chrome soon.

Adobe itself portrayed its decision to end-of-life Flash as being driven by technology trends. In an alert Tuesday, Adobe said technologies such as HTML5, WebGL, and WebAssembly have matured to a point where they have become viable alternatives to Flash for multimedia content on the Web.

Most browser makers have begun integrating capabilities directly into their browsers that were once available only via plugins like Flash. Given this progression, Adobe has decided to terminate support for Flash at the end of 2020, the company said.

Microsoft, Google, and Apple issued simultaneous alerts endorsing the move while reminding users of previously announced plans for phasing out support for Flash in each of their products soon.

Facebook, a platform for which many developers have built Flash-powered games, noted how the evolution of WebGL and HTML5 standards had almost made Flash obsolete, and it urged developers to follow the deadlines set by browser makers. Games built on Flash will continue to run through the end of 2020, but developers should make plans for migrating to other technologies soon, the company noted.

"Adobe Flash has been heavily leveraged in advertising, media, and e-learning spaces," says Mark Butler, CISO of Qualys. "But unfortunately, Adobe has not kept pace with the necessary security updates in order to outweigh the benefits of using the product."

Organizations that rely on Flash should consider moving to HTML5 quickly as it meets the functional needs that Flash previously met. Unlike Flash, HTML5 doesn't require any plugins and allows for seamless inclusion of audio and video files into code, he says. HTML5 is also an open technology that all new browsers have begun to incorporate.

"Security best practice dictates removal or maintaining current patch levels of Adobe's Flash and Java software versions," he said.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NeilB915
50%
50%
NeilB915,
User Rank: Moderator
9/26/2018 | 3:28:12 AM
Re: Good news indeed
Thnaks for updating this relevant information about Adobe's Move to Kill Flash. As we know that Flash is used by millions of website & the majority of computer in the world have flash installed. Nowadays, Adobe Flash become one of the biggest threats for computer Security. If anyone still having any doubt then i suggest you to contact with Adobe Phone Number to clear your doubt.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/27/2017 | 8:34:57 AM
Good news indeed
Flash is one of the worst doors for malware and cyber-intrusion EVER - that and JAVA.  Getting rid of Flash would be a big benefit going forward, getting Flash OFF the gazillion systems it is installed on is harder.  Now, if we can start coming up with something better than JAVA???
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.