Mozilla blocks all Flash in Firefox after third zero-day

[IDemo]

Source: Computerworld

Mozilla on Monday began blocking all versions of Adobe Flash Player from running automatically in its Firefox browser, reacting to news of even more zero-day vulnerabilities unearthed in a massive document cache pilfered from the Italian Hacking Team surveillance firm.

Computerworld confirmed that the current production versions of Firefox -- dubbed v. 39 -- on both Windows and OS X now block Flash.

Mozilla engineers swung into action over the weekend after reports surfaced late Friday of another Flash zero-day -- the term that describes a flaw for which there is yet no fix, or patch -- discovered in the gigabytes of data and documents stolen from the Hacking Team. At the time, the bug was the second in Flash spotted in just five days.

Since then a third Flash zero-day has cropped up.

Read more: http://www.computerworld.com/article/2947898/security/mozilla-blocks-all-flash-in-firefox-after-third-zero-day.html

[Surya Gayatri]

1. Have had to override it several times already. Being almost 100% sure of site in question.

[Paper Roses]

2. So, what do we do, uninstall Flash totally?

Sunday I uninstalled the old version and installed the current. Now another problem. Should we remove it altogether until the problem is resolved? Since I'm computer dumb, what will happen without Flash?

[Surya Gayatri]

3. Mozilla gives you the option to override the block if you're 100% sure of the video and site.

[Erich Bloodaxe BSN]

4. I actually just today installed the new version of flash.

It had been nagging me to update for a month or two.

[joshcryer]

17. Flash will probably have it patched in a day or two.

And Firefox might remove the warning then.

Until then you'll just have to tell it to allow until the patch comes out and just keep checking the Adobe site for the patch.

[LiberalElite]

5. So THAT's what's going on - thanks for posting! eom

[ffr]

27. Same here. Good to know why. Thx DU! n/t

[Pacifist Patriot]

6. I use Firefox and have been wondering what in the world was going on.

Thanks!

[Ex Lurker]

7. I'm running Linux

No worries.

[elias49]

10. What flavor?

I had a dual boot box around 10 years ago and ran Red Hat for a while. Then Slackware. But I found that I couldn't get all the software I wished for and so went back to Windows on my desktop and have A MacBook Air for travelling.

[Ex Lurker]

14. Mint 17.1

Started out with Ubuntu, but I like the Mint interface better.

[PersonNumber503602]

34. Are you using Cinnamon?

You could always put Cinnamon on a ubuntu system. But unless you already had a ubuntu system that you didn't want to trash, I don't see why anyone would want to do that.

[Ex Lurker]

36. Yes, Cinammon

One thing I do like about Ubuntu is the rolling upgrades, which make upgrading to a new version very easy. Upgrading Mint is a bit of a pain.

[Recursion]

12. Flash's security record on Linux is atrocious

The Pepper library that comes with Chrome is somewhat better.

Personally I'm on OpenBSD and very happy that web pages no longer animate...

[Snarkoleptic]

8. Seems that Italian firm "Hacking Team" has some high profile clients for it's spyware.

http://anonhq.com/leaked-documents-show-fbi-dea-army-can-control-your-computer/

Leaked emails from an Italian-based hacking company reveal that government agencies engage in surveillance more invasive than previously thought, spending millions of dollars on spyware and malware software to accomplish their questionable goals. Tellingly, their use of the product places them squarely in the same category as other repressive regimes around the world.

After hackers ironically hacked Hacking Team, a Milan-based company that sells strictly to governments, hundreds of gigabytes of emails and financial records were leaked. The emails show that the FBI, DEA, and U.S. Army all purchased software that enables them to view suspects’ photos, emails, listen to and record their conversations, and activate the cameras on their computers, among other things.

While this may seem like old news, the most controversial revelation was the government’s purchases of “Remote Control Systems.” The FBI, DEA, and U.S. Army, courtesy of Hacking Team, possess the capability to take control of a suspect’s computer screen. The technology is so invasive that even the DEA, known for its violative surveillance policies, had reservations about purchasing it.

According to documents obtained by The Intercept, an internal request to purchase RCS was denied by DEA management in 2011 because it was “too controversial.” By 2012, however, the DEA had resolved its concerns, likely spending a similar amount to the $773,226.64 (plus thousands in maintenance fees) the FBI invested in its own set of software.

Nice to see the DEA had "resolved its concerns". My BS meter is off the scale with that statement.

[Sunlei]

13. yes, NSA 'hacks' to gather all their info about people. It must be easy for clever criminals

to use the same "door" NSA installed and uses.

[joshcryer]

16. This "Hacking Team" story is as big as the NSA files.

But no one cares because it's not the big old ugly USA doing it.

Just proves that all countries love to spy on everyone including their own people.

Quite unfortunate.

And good on Firefox for blocking Flash.

[romanic]

9. Just noticed this today.

WTF is going on here? :/

[Sunlei]

11. anyone think this hack will work easy on cell phones, especially texts or twitter where people

do view videos, pictures and also use their cell phones to bank and pay with credit cards?

advertisers use flash add ons, be so easy to attach a hack to all the ads on those venues. and aps of all types.

[bigwillq]

15. Now I know why it's been doing that.

Thought it was my computer, I've had some issues with my computer lately.

Thanks for posting.

[LittleGirl]

18. had a crash earlier and had to quit flash player, firefox

and reboot. Locked me up but good. I've updated it twice recently. I hope someone posts the update so I know when to do it again. ugh. So frustrating!

[SmittynMo]

19. They've had problems for months

It was so bad, my browser was slower than 56k days. I had sound playing for no reason, and all other flash related issues. Now that the crap is being blocked, my browser works much better.

Think about it. If you're going to hack something, find software that is widely used by all machines and hack it. You watch, Java will be hit next.

[Tommy_Carcetti]

20. There was a sports related forum that I loved to visit but they were heavy on Flash advertising.

I use Mozilla for my home browser and it rendered the site nearly unusable, which was a shame because it was a cool community.

Now that Flash has been suspended, I can actually visit it again.

[onehandle]

21. Macs are sold without Flash installed.

For good reason.

Flash is decades old crap code. It needs to die.

[whatthehey]

24. And when you get the BBC and many premium video streaming sites to agree

THAT would be the time to kill flash.

Otherwise it's just easier to use flash block on Chrome to disable autoplay then click on whatever you choose to watch You know, for the benefit of users.

[hunter]

22. I've avoided Flash for years. I simply don't install it.

I suspect it's always been a tool for surveillance, and not just for marketing people weaseling around browser ad-blocking software and privacy settings.

"It's not a bug, it's a feature!"

If a website insists on using Flash, it's their loss, not mine. I don't have to look at their content if they don't want me looking at their content.

It's not that I ever buy much of anything anyways but for necessities, occasional small entertainments, thrift store, and salvage stuff, as I'm the cantankerous sort who believes all major corporations are guilty until proven innocent.

[Xyzse]

23. I was wondering about that yesterday as well.

I haven't really bothered, since I was mostly just reading translated web-novels, before sleeping.

Thanks.

[Ghost Dog]

25. Good. Please block all Shockwave

sh*t too. Thanks.

[snagglepuss]

26. Is this a problem only for Firefox. I use Chrome a whe I tried to nd

update, I got message that all Flash updates are automatic? I'm dumb as door nails when it comes to computers, so should I,a Chrome user, be concerned about this?

[ffr]

28. Yes, IE and Chrome use there own Flash plug-ins

You'll need to keep all your browser plug-ins patched and up to date.

Firefox helps users to this end, with a one-stop checkup. Select Tools*, Add-ons, Plug-ins, then click Check to see if your plugins are up to date. Update all those that are out of date.

* All versions of Firefox since v24, I believe, are (annoyingly) preconfigured to hide the standard menu bar. Use Alt-F to prompt it, then View, Toolbars, Menu Bar. Or the keyboard shortcut to Add-ons is: {Ctrl]-[Shift]-A.

[PasadenaTrudy]

29. I was wondering what this was all about! n/t

[lindysalsagal]

30. I never use Mozilla anymore.

It seems to be a problem no matter what.

[Gloria]

31. I had a blocked video a short while ago, with a message about an out of date plug in..

So, I followed the link and downloaded something new,,,and it automatically uninstalled the old version...,and it seems ok now...
this just after doing an update just a few days ago...

[undiegrinder]

32. There's finally a patch Firefox won't block.

It's version 18.0.0.209:

https://get.adobe.com/flashplayer/?PID=7103102

[Mnemosyne]

33. Hi undiegrinder! Just have to tell you that your sigline is hysterical. I loved those guys.

[undiegrinder]

37. Thank you! Sounds like you might enjoy its source ...

It's from a blog called "Classic Television Showbiz":

http://classicshowbiz.blogspot.com/2014/12/an-interview-with-dick-gautier-part-one.html

[PersonNumber503602]

35. I'm kind of glad. Maybe this will be final nail in flash's coffin

This would have been extremely disruptive five or six years ago though.