Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

Flash continues to be technology riddled with critical security flaws

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

February 3, 2015

Click here to order the best deal on a HP enterprise dedicated server and at a great price.

System admins that patched Adobe's Flash plugin last week are sadly mistaken if they think their apps are now safe from hackers. The technology still contains serious security flaws that need to be addressed.

Adobe is warning that yet another programming blunder in its code is currently being exploited in the wild, and says it won't have a security patch ready to deploy until sometime this week or next.

This latest security vulnerability is, as always, triggered when the plugin tries to play a malicious Flash file – allowing hackers to download malware onto PCs and effectively hijack the computers so that passwords and more data can be stolen.

According to Trend Micro, the Angler exploit app was updated to leverage this particular security flaw, and used to inject malware into PCs visiting web video site dailymotion.com via a dodgy ad network.

Web browsers were told to fetch retilio.com/skillt.swf, which was booby-trapped to exploit the zero-day security vulnerability.

"So far, we’ve seen well over 3,290 hits related to the exploit, and with an attack already seen in the wild, it’s likely that there are several other attacks leveraging this zero-day security flaw, posing a great risk of system compromise to unprotected systems," said Peter Pi, threats analyst at Trend Micro (TM).

TM first noticed miscreants exploiting the security hole in the wild on January 14. The company is holding on to the rest of the technical details of the vulnerability until a permanent fix is available, and that's not going to be for a while.

Monday's security advisory is very similar to the previous two critical security flaws discovered in Flash, which were revealed just two weeks ago and also used in the Angler exploit hole.

Both have now been patched so far, but not after infecting ads served on smut site xhamster.com and to slurp the private information of onanistic internet users.

Using compromised ad networks to infiltrate computers and mobile devices is a very popular technique, since it takes a layer of human interaction out of malware delivery.

Rather than convince someone to download a nasty software piece as a disguised spreadsheet, porn pic, or an app upgrade, the ad network serves it to the passing browser, which hands it to Flash, and there everything falls over.

"Any time you have an attack vector that's so widely exploited you'll need to minimize its utilization," said Craig Williams, technical leader at Cisco's Talos Security Intelligence Group.

"If in the real world you can't do without it, then you have to make sure you run it in a particular browser that isn't susceptible," adding that he personally uses Chrome – which goes out of its way to sandbox Flash, limiting the plugin's reach if it is compromised, he added.

Source: Cisco Talos Security Intelligence Group.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer