Adobe Flash exploit that was leaked by Hacking Team goes wild; patch now!
Source: Ars Technica
Hours after the 0day was found, it was added to popular exploit kits.
Adobe Systems has updated its Flash media player to patch a vulnerability that attackers started exploiting soon after attack code leaked from the devastating Hacking Team breach.
As Ars reported Tuesday morning, the previously unknown Flash vulnerability was part of some 400 gigabytes of data dumped on the Internet by unknown attackers who hacked Hacking Team over the weekend. By Tuesday afternoon, the critical flaw was being targeted in the wild by an array of malware titles, including the Angler and Nuclear exploit kits, as first reported by Malwarebytes (and later documented by the security researcher known as Kafeine). The exploit has also been folded in to the Metasploit hacking framework.
The vulnerability is cataloged as CVE-2015-5119 and is active in Flash versions 18.0.0.194 and earlier. According to security firm Rapid 7, it stems from a use-after-free bug that can be exploited while Flash is handling ByteArray objects. The update is available for Windows, Mac OS X, and Linux systems. Adobe has credited Google's Project Zero and Morgan Marquis-Boire, director of security, First Look Media, for reporting the critical bug and working to protect Flash users.
With the exploit folded into exploit kits that are available on the Internet, users who rely on Flash should install the update immediately (don't forget to uncheck the boxes Adobe shamelessly checks by default to promote crapware). Readers may also want to experiment with uninstalling Flash altogether. If the results are acceptable, that's a more secure alternative since it drastically reduces attack surface.
<snip>
Read more: http://arstechnica.com/security/2015/07/adobe-flash-exploit-that-was-leaked-by-hacking-team-goes-wild-patch-now/
House of Roberts
(5,177 posts).
riversedge
(70,242 posts)This was posted at the end of the article.....
Promoted Comments
acetothermusSmack-Fu Master, in training
jump to post
Instead of going to Adobes "main" download page go here...
http://www.adobe.com/products/flashplay ... tion3.html
Always download the offline installers of these apps because you don't get the crapware. Just the app you want to update.
PatrynXX
(5,668 posts)Considering the source I would say PATCH IT. if you installed it. Obama bothered to say don't a few years ago but some of us don't have much choice
Romeo.lima333
(1,127 posts)bananas
(27,509 posts)Surveillance company loses control of flagship spy program
42 minutes ago
Italian surveillance company Hacking Team said Wednesday that it had lost control of its custom-built spy software, unleashing a new threat onto the Internet and depriving the company of its top selling point.
In a statement, Hacking Team said it believed anyone could now deploy its RCS software "against any target of their choice."
"We believe this is an extremely dangerous situation," the company said.
<snip>
Meanwhile software maker Adobe Systems Inc. says it is hoping to fix a critical flaw in its Flash Player program which was revealed when RCS became public.
A patch is expected later Wednesday.
riversedge
(70,242 posts)bananas
(27,509 posts)And I'm busy with other stuff, so I won't get to it til much later today.
Orrex
(63,216 posts)bananas
(27,509 posts)Elmer S. E. Dump
(5,751 posts)Problem solved.
riversedge
(70,242 posts)LittleGirl
(8,287 posts)I knew something was wrong with flashplayer. It's been giving me fits for a week.
gvstn
(2,805 posts)I haven't seen any posts that say the old must be deleted and the new installed from scratch.
Are you just being cautious or is there a particular reason?
Thanks!
Elmer S. E. Dump
(5,751 posts)Paper Roses
(7,473 posts)bananas
(27,509 posts)Adobe tackles new Flash threat after Hacking Team leak
By Chris Foxx Technology reporter
8 July 2015
Adobe has updated its Flash software to fix a security hole, which was made public only after data was stolen from an online surveillance company.
Italian firm Hacking Team sells spying software to intelligence agencies around the world.
On Sunday, private data stolen from the company was posted online, indicating it knew about a serious flaw in Flash, but had not told Adobe.
One security blog said the bug had been "immediately weaponised" by attackers.
"This is one of the fastest documented cases of an immediate weaponisation in the wild, possibly thanks to the detailed instructions left by the Hacking Team," wrote Jerome Segura from Malwarebytes.
<snip>
bananas
(27,509 posts)Italian surveillance company hacked, documents stolen
By Raphael Satter, Associated Press
July 6th, 2015 @ 12:51pm
LONDON (AP) An Italian surveillance firm known for selling malicious software used by police bodies and spy agencies has succumbed to a cyberattack, the firm's spokesman said Monday, confirming an embarrassing breach which sent documents and invoices ricocheting across the Internet.
<snip>
Still, some of the billing records being shared online appeared to corroborate work by Citizen Lab, a research group at the Munk School of Global Affairs at the University of Toronto, which has linked Hacking Team to two dozen countries, including several with atrocious human rights records.
"Early reports ... appear to validate our research showing use by repressive regimes like Ethiopia and Sudan," Citizen Lab said in a statement. "These reports point to the lack of transparency and accountability around the market for intrusion software. We think that a better understanding of this market is essential for a free and secure Internet."
The Milan-based company has been the subject of increased scrutiny after its malware was discovered targeting a series of journalists and activists.
SoapBox
(18,791 posts)What a mess.
I do have to say that thanks to a post previously by bananas, I had added Malwarebutes when it was free for life.
Triana
(22,666 posts)Leith
(7,809 posts)Flash is updated on all computers in my house.
PADemD
(4,482 posts)Do I need to update again?
herding cats
(19,565 posts)Go here and update. https://get.adobe.com/flashplayer/
hunter
(38,317 posts)I don't install it on my computers.
If I can't see something on a website because it's using Flash, it's their loss, not mine.
onehandle
(51,122 posts)The Web is so much more of a pleasure without it.
Uninstall it. Don't look back.
Delphinus
(11,831 posts)uninstall. My laptop has been rather slow lately, even Firefox.
PoliticAverse
(26,366 posts)passiveporcupine
(8,175 posts)I don't even think I can update it because of Chrome.