Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:35 PM
Connect Directly

By Renaming Flash Professional, Adobe Does Little To Alleviate Security Concerns

More than a rebranding, what is really needed is an end to Flash, say some security analysts.

In giving Flash Professional CC a new name this week, Adobe only appears to have prompted fresh questions on when exactly the company plans on phasing out the notoriously buggy technology entirely, instead of just trying to distance itself from it.

Adobe on Monday announced that Animate CC would be the new name for Flash Professional CC.  Animate will become available early next year and will serve as Adobe’s primary animation tool for developing HTML5 content, the company said. The company will also release a video player based on HTML5 for desktop browsers to complement its support for the technology on mobile browsers.

Adobe described the rebranding as part of a broader effort by the company to move to new standards like HTML5 for running animations, multimedia, and video in web browsers. Standards like HTML5 have matured to a point where they provide many of the capabilities that Flash does and customers have said they would like Adobe to adopt such standards, the company noted.

According to Adobe, the rebranding is necessary because they have completely rewritten Flash Professional over the past several years and the product now integrates native HTML5 and support for WebGL. Over one-third of the content created in Flash Professional already is based on HTML5 rather than the Flash format and the name change reflects that evolution, the company said.

Looking ahead, Adobe wants content creators to build apps using the new standards, while the company will focus on supplying tools and services around them. At the same time though, Adobe’s commitment to the creation of new Flash content will continue. “Moving forward, Adobe is committed to working with industry partners, as we have with Microsoft and Google, to help ensure the ongoing compatibility and security of Flash content,” the company said.

Facebook, which earlier this year famously called on Adobe to announce an end-of-life date for Flash, has agreed to work with the Adobe instead. According to Adobe, the two companies will work together to ensure that Flash gaming applications run securely on Facebook. “As part of this cooperation, Facebook will report security information that helps Adobe improve the Flash Player,” Adobe said.

Adobe’s decision to give Flash Professional a new name may well be an attempt to distance itself from a technology that has the unenviable reputation of being among the most vulnerable ever. But it has done little to assuage growing concerns over the security threats posed to users by Flash technology.

“A buggy app is still a buggy app by any other name,” says Richard Stiennon, chief research analyst at IT-Harvest.

Over 50 of 317 yet-to-be-published security advisories involving vulnerabilities discovered by researchers at Tipping Point’s Zero-Day Initiative involve Adobe.

And that’s just the tip of the iceberg. A report released this week by Flexera Software shows that Microsoft ended up as the vendor with the most vulnerable products over the last three months largely because many of the products came bundled with buggy versions of Adobe Flash. Another recent report by Recorded Future showed that eight of the top 10 vulnerabilities used by exploit kit makers in 2015 were in Adobe Flash Player.

The sheer number of recently discovered bugs in Adobe Flash Player and its popularity among exploit kit makers and APT groups such as Pawn Storm raise questions about Flash’s role in a secure environment, Recorded Future had noted.

In that context, it’s possible to see why Adobe may have chosen to rebrand the product, says Scott Donnelly, director of presales at Recorded Future. “It’s a smart branding move for Adobe, due to the heavy associations Recorded Future sees between exploit kits and Flash,” he says. 

“However, based on multiple sources from the web, the product’s security posture remains unchanged for the millions of people who use Flash on a daily basis,” Donnelly says.

So far at least, Adobe has said nothing to indicate that Animate CC will be a major security upgrade over Flash Professional, says John Pescatore, director of emerging security trends at the SANS Institute. “They do seem to be trying to encourage HTML5 output, which is a good thing, but rather than see more features I would have preferred first hearing about a gigantic and deep security push,” Pescatore says.

Users should try to move away from Flash where possible, he says. “Personally, I think the cold turkey approach would be the best way to go. I think users would get over the lack of Flash within a week, if not faster,” he says.

But neither Pescatore nor Stiennon expect to see Flash go away anytime soon.

“Flash is going to be around at least as long as Windows XP,” Stiennon says. “There are too may legacy sites that continue to use it.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
12/4/2015 | 6:49:32 AM
Real Study
what really needs to be studied is: how does attack code manage to jump from an adobe stream and become executable on the victim?     either as user mode or into kernel mode .    this is the door that must be closed: an application program must not be able to compromise its host os
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-18
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
PUBLISHED: 2021-06-18
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
PUBLISHED: 2021-06-18
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.