4 ms·

> While Yahoo acknowledged the attack, the company said that it was not nearly as big as Malwarebytes had portrayed it to be. Prove it, give us the numbers >

by aikah 11y ago

> While Yahoo acknowledged the attack, the company said that it was not nearly as big as Malwarebytes had portrayed it to be. Prove it, give us the numbers > “The majority of attacks we are seeing are exploiting software installations that are not up-to-date on the latest security updates,” said Wiebke Lips, a spokeswoman for Adobe. Then your plugin should stop working by itself when a new version is available, that's how you force users to update if you are a responsible vendor. But of course you don't do that. I like Flash as a creative tool, but clearly people should stop using it on the web,and browsers should ban it like they banned java on the web. It's just too dangerous and vendors often wash their hands off any consequences. Hopefully the flash IDE can work with webassembly and give up the plugin. If Adobe doesn't do that, someone else will and Flash will be buried for good.

eli 11y ago
> Then your plugin should stop working by itself when a new version is available, that's how you force users to update if you are a responsible vendor That's an interesting idea. Is it practical? I think you'd need to run some flash code first to determine the flash version before loading the ad code... I suspect it would take too long.
- Daviey 11y ago
  No, just do it in js.. https://code.google.com/p/swfobject/ https://code.google.com/p/swfobject/ But.. I really don't think it is the responsibility of a content provider to do version blocking.. that causes bad karma. The responsibility is the platform, either Adobe itself or the container, which is the browser. Either way, I struggle to think Yahoo is to blame.
  - granos 11y ago
    Yahoo bears some, but not all, responsibility. As for version blocking you are correct that that falls entirely on Adobe and the browser. One of the most difficult parts of an attack like this is to get people to actually "run" the malicious code. In this case that meant loading some flash object. Embedding malicious flash is one of the easiest ways to get a person to run your code, but you need a popular site to do anything large scale. Yahoo is responsible in that they own a vector (their ad network paired with their popular web properties) that makes this large scale distribution trivially simple for the attacker. Content providers (web property owners) should be responsible for the ads that get served on their site but, given how the ecosystem has evolved, they have very little control. The most a content creator can do is switch to a different ad network. This case is interesting because the ad network and the content property were owned by the same entity; switching networks makes no sense. The quality/safety of ads is left up to the network and the ad creators. Obviously the creators cannot be trusted. The network has little incentive to police thoroughly (although it seems like Yahoo did take some action in this case). There is such a glut of ad real estate that individual content creators have effectively zero power to affect change. If one of the networks strove to promise a better experience for the content providers (and us; the ultimate consumer) it could cause content providers to switch networks. But that costs money and no ad network has the incentive to be first. They simply don't need to in order to continue being competitive. It will be interesting to see what happens in the next few years. It seems like companies (Apple in particular) are starting to try to gobble up as much content as possible. If enough providers sign on to such programs, these "co-ops" could have significant bargaining power with regards to the ad networks. But who knows what other issues will crop up. Today everybody has a website or a blog that they need to independently monetize via ads. Grouping together under the banner of a large company could work well for them, or they could effectively become web serfs. It'll be interesting to see either way.
  - Sanddancer 11y ago
    Yahoo should shoulder blame here. They did no vetting of the objects they allowed to run from their servers. Had they been responsible and checked the ads beforehand, the people they were serving content to would not have been infected.
- TeMPOraL 11y ago
  That's an excellent way to piss off your users. I can forgive it in case of a legitimate 0-day floating around, but come on - sometimes the user doesn't want to, or can't upgrade (e.g. running without installation privileges, common at universities and in corporate environments). I like the way Firefox approaches it - it disables the outdated Flash plugin and in place of Flash content it renders boxes that say why the plugin was turned off and give option to manually enable it if I'm really, really sure. It's annoying enough to force people to update while still giving you an option to run the old version if you absolutely have to.
  - Karunamon 11y ago
    Yeah, this. The amount of pure rage inside my department directed at Java because of their boneheaded security stuff is enough to power a small city. Okay, so open up the management interface for my SAN. Yes, I want to allow Java to run. Yes, I know it's not signed. No, I don't care. Okay, now I have to go add the domain to an obscure control panel because a freakin' popup is too much to ask. Now I go reload the page, yes I want to run the plugin, no I don't care that it's unsigned, yes I know that this may hose my computer, yes* i want to load the damned applet already. Combine that with the fact that the Java web plugin sandbox and all this security appears to be trivially bypassed, and I wish they'd screw off with the multiple confirmation prompts and let me just control it with the browser. * The number of times I've cared about the code signing status of any application in the last decade can be counted on one hand.
  - justizin 11y ago
    > It's annoying enough to force people to update while still giving you an option to run the old version if you absolutely have to. FireFox now has changed the default to click-to-activate for the Flash plugin, but this behavior a couple of years ago led me to enable click-to-activate on all my computers, when I opened up an older machine I hadn't fired up in a while and noticed that Flash was conveniently disabled everywhere. Until FF's recent change, this behavior broke a lot of websites, and clearly now they're fixing their interaction with click-to-activate behavior. Some sites would have an element with js handlers over the flash plugin for ads or something else, some would just display a message that's like, "You should download the flash player", which meant they were entirely broken.
- bobajeff 11y ago
  He was referring to Adobe not Yahoo. So no they wouldn't need to run flash code first it could just check a database to see if it's blacklisted on account of a zero day and refuse to run like Firefox did but from the plugin itself.
  - eli 11y ago
    Adobe already has an "automatically install updates" option that it encourages you to accept. If I wanted version blocking, I don't think I'd want to rely on Adobe to provide it.
- tomjen3 11y ago
  I used an android app that did that - I no longer use it. Just require users to click to enable plugins and that should take care of everything.
userbinator 11y ago
It's Adobe's implementation that's the problem, not the concept. I think it's better as a plugin because then you get to easily enable/disable it (off by default is good) and the browser can also isolate it; something not so easily done for built-ins like JS.
- kevin_thibedeau 11y ago
  > I think it's better as a plugin Except that every instance runs as its own process. A page with a dozen flash ads is a dozen flash programs all hogging memory and processor cycles, happily exposing holes in your security.
  - pas 11y ago
    That's actually a plus. OSes have good isolation for processes, and good performance fixes (shared read-only pages) on top of that. Browser developers implementing sandboxing is not exactly the best use of their time and expertise. The problem is that instead of the browser streaming user interaction events to the Flash (or any NPAPI plugin) process and asking for a render from time to time, the plugin window is overlaid on the browser, and waits patiently for events streaming down from the mighty plugin.
mccr8 11y ago
Chrome autoupdates Flash and Firefox blocks old versions of Flash. (I'm not sure what IE does.) That should help limit the number of people who are exposed.

by aikah 11y ago

eli 11y ago

> Then your plugin should stop working by itself when a new version is available, that's how you force users to update if you are a responsible vendor That's an interesting idea. Is it practical? I think you'd need to run some flash code first to determine the flash version before loading the ad code... I suspect it would take too long.

Daviey 11y ago
No, just do it in js.. https://code.google.com/p/swfobject/ https://code.google.com/p/swfobject/ But.. I really don't think it is the responsibility of a content provider to do version blocking.. that causes bad karma. The responsibility is the platform, either Adobe itself or the container, which is the browser. Either way, I struggle to think Yahoo is to blame.
- granos 11y ago
  Yahoo bears some, but not all, responsibility. As for version blocking you are correct that that falls entirely on Adobe and the browser. One of the most difficult parts of an attack like this is to get people to actually "run" the malicious code. In this case that meant loading some flash object. Embedding malicious flash is one of the easiest ways to get a person to run your code, but you need a popular site to do anything large scale. Yahoo is responsible in that they own a vector (their ad network paired with their popular web properties) that makes this large scale distribution trivially simple for the attacker. Content providers (web property owners) should be responsible for the ads that get served on their site but, given how the ecosystem has evolved, they have very little control. The most a content creator can do is switch to a different ad network. This case is interesting because the ad network and the content property were owned by the same entity; switching networks makes no sense. The quality/safety of ads is left up to the network and the ad creators. Obviously the creators cannot be trusted. The network has little incentive to police thoroughly (although it seems like Yahoo did take some action in this case). There is such a glut of ad real estate that individual content creators have effectively zero power to affect change. If one of the networks strove to promise a better experience for the content providers (and us; the ultimate consumer) it could cause content providers to switch networks. But that costs money and no ad network has the incentive to be first. They simply don't need to in order to continue being competitive. It will be interesting to see what happens in the next few years. It seems like companies (Apple in particular) are starting to try to gobble up as much content as possible. If enough providers sign on to such programs, these "co-ops" could have significant bargaining power with regards to the ad networks. But who knows what other issues will crop up. Today everybody has a website or a blog that they need to independently monetize via ads. Grouping together under the banner of a large company could work well for them, or they could effectively become web serfs. It'll be interesting to see either way.
- Sanddancer 11y ago
  Yahoo should shoulder blame here. They did no vetting of the objects they allowed to run from their servers. Had they been responsible and checked the ads beforehand, the people they were serving content to would not have been infected.
TeMPOraL 11y ago
That's an excellent way to piss off your users. I can forgive it in case of a legitimate 0-day floating around, but come on - sometimes the user doesn't want to, or can't upgrade (e.g. running without installation privileges, common at universities and in corporate environments). I like the way Firefox approaches it - it disables the outdated Flash plugin and in place of Flash content it renders boxes that say why the plugin was turned off and give option to manually enable it if I'm really, really sure. It's annoying enough to force people to update while still giving you an option to run the old version if you absolutely have to.
- Karunamon 11y ago
  Yeah, this. The amount of pure rage inside my department directed at Java because of their boneheaded security stuff is enough to power a small city. Okay, so open up the management interface for my SAN. Yes, I want to allow Java to run. Yes, I know it's not signed. No, I don't care. Okay, now I have to go add the domain to an obscure control panel because a freakin' popup is too much to ask. Now I go reload the page, yes I want to run the plugin, no I don't care that it's unsigned, yes I know that this may hose my computer, yes* i want to load the damned applet already. Combine that with the fact that the Java web plugin sandbox and all this security appears to be trivially bypassed, and I wish they'd screw off with the multiple confirmation prompts and let me just control it with the browser. * The number of times I've cared about the code signing status of any application in the last decade can be counted on one hand.
- justizin 11y ago
  > It's annoying enough to force people to update while still giving you an option to run the old version if you absolutely have to. FireFox now has changed the default to click-to-activate for the Flash plugin, but this behavior a couple of years ago led me to enable click-to-activate on all my computers, when I opened up an older machine I hadn't fired up in a while and noticed that Flash was conveniently disabled everywhere. Until FF's recent change, this behavior broke a lot of websites, and clearly now they're fixing their interaction with click-to-activate behavior. Some sites would have an element with js handlers over the flash plugin for ads or something else, some would just display a message that's like, "You should download the flash player", which meant they were entirely broken.
bobajeff 11y ago
He was referring to Adobe not Yahoo. So no they wouldn't need to run flash code first it could just check a database to see if it's blacklisted on account of a zero day and refuse to run like Firefox did but from the plugin itself.
- eli 11y ago
  Adobe already has an "automatically install updates" option that it encourages you to accept. If I wanted version blocking, I don't think I'd want to rely on Adobe to provide it.
tomjen3 11y ago
I used an android app that did that - I no longer use it. Just require users to click to enable plugins and that should take care of everything.

userbinator 11y ago

It's Adobe's implementation that's the problem, not the concept. I think it's better as a plugin because then you get to easily enable/disable it (off by default is good) and the browser can also isolate it; something not so easily done for built-ins like JS.

kevin_thibedeau 11y ago
> I think it's better as a plugin Except that every instance runs as its own process. A page with a dozen flash ads is a dozen flash programs all hogging memory and processor cycles, happily exposing holes in your security.
- pas 11y ago
  That's actually a plus. OSes have good isolation for processes, and good performance fixes (shared read-only pages) on top of that. Browser developers implementing sandboxing is not exactly the best use of their time and expertise. The problem is that instead of the browser streaming user interaction events to the Flash (or any NPAPI plugin) process and asking for a render from time to time, the plugin window is overlaid on the browser, and waits patiently for events streaming down from the mighty plugin.

mccr8 11y ago

Chrome autoupdates Flash and Firefox blocks old versions of Flash. (I'm not sure what IE does.) That should help limit the number of people who are exposed.