Two more Flash 0-days emerge in Hacking Team leak

http://www.theregister.co.uk/2015/07/12/adobe_flash_zero_day_cve_2015_5122/

by danso • 11 years ago

198 182 11 years ago

theregister.co.uk

a3n2• 11 years ago

Hacking Team developed digital smallpox, and failed to safeguard it.

Thanks.

tptacek3• 11 years ago

I'm as grossed out by HT as the next message board nerd, but they didn't develop these bugs; modern industrial software development did. All HT did was weaponize them. These guys aren't the sharpest tools in the shed, so I think you can safely assume other people weaponized these, or worse bugs, as well.

a3n2• 11 years ago

OK, point taken. But they had them in the lab, did not safeguard them properly (by demonstration), and deserve a shit ton of blame and scorn.

EthanHeilman3• 11 years ago

HT purchased these vulnerabilities with an understanding that they would not be made public and patched. Then they failed to safeguard them. Clearly these O-days, and conceivably all computer vulnerabilities, are not close to being as bad as smallpox, but what ethical obligations do actors (companies, governments, hackers, researchers) have to protect vulnerabilities which they plan to not protect the public again?

Say you discover a very powerful attack on AES which allows you under many circumstances to recover the key:

1. do you have an ethical obligation to warn affected parties?

2. If you don't and instead secretly sell this decryption capability to governments and/or private actors, do you have an obligation to ensure that this capability isn't used illegally or unethically?

3. What due diligence is required to protect a vulnerability of this scale?

ceejayoz4• 11 years ago

And this is just one non-governmental setup's arsenal.

vtsrh• 11 years ago

The good part is that this removes the same vulnerability for everyone.

ceejayoz4• 11 years ago

My point, though, is that if a random Italian consultancy can amass multiple Flash 0-days, the folks at the NSA with the $10+ billion budget probably have an essentially endless supply of them (not to mention exploits for other software) at the ready.

bohm• 11 years ago

guess it's time to disable flash for a few weeks...

ghshephard3• 11 years ago

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago, when all the zero-days became a monthly occurrence. The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching.

I have not once every missed having flash on my system. It's not just the case that the web is useable, it's that, with the single exception of the BBC, it doesn't seem to use it anywhere I visit.

joosters2• 11 years ago

The BBC site will use non-flash videos if you browse it on an iPad, but they don't seem smart enough to serve these to you if you use a desktop browser with flash disabled.

Presumably they could implement a non-flash fallback for users but unfortunately they just haven't bothered.

I tried to cheat by modifying my User-Agent to pretend to be an iPad but had no luck...

dhimes3• 11 years ago

I'm on some troubleshooting pages for canon that require flash. Seems they are in the process- as there are html 5 vids on the site as well.

ExpiredLink• 11 years ago

The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching.

[citation needed]

smackfu• 11 years ago

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago

That seems unlikely. Maybe HN users, but that's not really representative of web users overall

sebcat• 11 years ago

I've been running without Flash for a couple of years now. The only thing I can't do that I would like to be able to do is to watch Facebook videos. Other than that, not having Flash installed is not a problem for me.

degenerate• 11 years ago

Facebook doesn't use HTML5? Why?!

bratch• 11 years ago

Swap the "www" in the URL for "m" on a video page and you'll get a low resolution HTML5 video!

chinathrow2• 11 years ago

No, it's time to uninstall all plugins for good.

jimmaswell2• 11 years ago

I just set it to only activate when I approve it, for if I'm on a trusted website.

dhimes3• 11 years ago

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

archgoon2• 11 years ago

A lot of advertising networks use it to deliver advertisements. Whether it is simple inertia at this point, or because the networks can get a better fingerprint using flash, I don't know.

Also, it used to be the case that Flash had better DRM controls on it, but I'm pretty sure that reason is no longer the case since Encrypted Media Extensions got rolled out.

However, that doesn't explain why Facebook's on-site video player uses Flash.

shimfish• 11 years ago

Facebook appears to have moved to an html player in the last few days.

bydo• 11 years ago

Which is what makes these exploits so insidious: sneak an infected advertisement onto one network, even briefly, and you're now targeting who knows how many Internet users visiting legitimate, trusted websites.

Honestly, one of the biggest reasons to run an ad blocker is the significantly reduced attack surface.

ninkendo• 11 years ago

The advertising networks being the last to use it is something that will make Flash's implosion very quick and sudden, IMO.

If uninstalling flash only causes you to miss out on ads, it makes uninstalling flash that much more attractive. Which makes the advertisers want to get off flash that much sooner.

It needs probably just one or two more use cases to disappear (Facebook video is one of them), and its final death will be quite quick.

steckerbrett• 11 years ago

What websites use it? I've not encountered a single incompatible website recently, and haven't had flash installed for a long time now.

skrebbel• 11 years ago

Porn sites.

therealmarv2• 11 years ago

FB is using it a lot. For videos, for uploading pictures.

archgoon2• 11 years ago

Facebook's inline video player uses it. On linux, I get a popup saying that I must install Flash.

dhimes3• 11 years ago

Good question. There were some I had to use Chrome to view (espn, cnn, facebook-- somebody) and I was quite surprised.

MatthiasP• 11 years ago

twitch.tv

Kliment• 11 years ago

BBC iPlayer is flash-only

Redoubts• 11 years ago

HBO Go

jimmaswell2• 11 years ago

YouTube's Flash player still works a lot better than the HTML5 one. Their HTML5 one desynchs the audio occasionally, cuts off the audio before the video ends, doesn't support a real right click -> copy video URL (all it can do is give a popup with the URL), and still has other small bugs. The Flash one has none of these problems.

It seems to be the case in general for most sites that offer HTML5 alternatives that the Flash version is much more solid. Maybe using HTML5 video in these domains is inherently error-prone, maybe it isn't, but in practice it almost always gets screwed up.

Plus people still use flash games and sites like Newgrounds.

frik• 11 years ago

The HTML5 video in iOS is rock solid (Safari/Chrome on iOS). The Chrome/Firefox/IE HTML5 video implementations could be a bit better (in comparison).

eridius2• 11 years ago

YouTube's HTML5 video player has always been a shit-show, and I don't understand why. Vimeo has had an excellent HTML5 video player for many years, and there's at least a few third-party HTML5 video players that are pretty good as well.

darklajid3• 11 years ago

Twitch. Which happens to amuse me, which I like to waste time. But .. they seem unwilling to move away from Flash (the only thing I found was a ~3 year old support thread that wants to .. support HLS. Yay. Not that's not helpful)

tl• 11 years ago

Twitch without Flash has been available for a while now, if you were willing to use VLC + an IRC client. Twitch HTML5 chat went live on June 30th, HLS was prior to that.

I'd say they're open to ditching Flash.

DrJokepu2• 11 years ago

Twitch works just fine with HTML5 these days, including chat.

feld4• 11 years ago

Ubiquiti products require it for some functionality, and they're wildly popular for Wifi and wireless ISPs right now.

I actually just filed a complaint on their forums.

http://community.ubnt.com/t5/UniFi-Wireless/BUG-Adobe-Flash-...

ran2903• 11 years ago

Their latest controller (v4?) removed the Flash requirement for both video (playback) and main (maps) IIRC. Do they still have leftover areas that require Flash?

Scarbutt• 11 years ago

What ubnt products require flash? airOS works fine for me without flash.

tammer• 11 years ago

This is like asking why people still use cash when there are so many other easier to use & manage payment options. The simple answer is there are far too many edge cases where it's still required - any single one doesn't sound like a good answer.

ams6110• 11 years ago

Cash is still the most anonymous way to pay for something also, at least for most people.

x0x04• 11 years ago

My 401k provider -- that btw I can't choose -- fucking uses flash for their entire website.

phn• 11 years ago

I think the truth is, technology that supplants it is still not there yet. Sockets, sound, video...

And there's still a truckload of fun games available only in flash form, which makes flash relevant even if the number of new stuff coming out in it dwindles.

marvel_boy• 11 years ago

Unfortunately advertising managers love Flash. Technicaly there is no reason to use (see iOS Safari HTML dealing with video).

sethd2• 11 years ago

I can think of one use case where Flash still makes sense: Live video

A lot of people seemed to be surprised this is the case but tell me what single live streaming protocol is supported across all browsers without a plugin?

With Flash you can stream HLS (HTTP Live Streaming) to a Flash player in full browsers while just directly loading the same HLS playlist in mobile browsers via native players (iOS / Android).

This means you can deliver live streaming over the same audio/video codec (H.264/AAC) and over the same protocol (HLS). This vastly simplifies your streaming infrastructure and removes the need for transcoding on the server, unless you just want to create different qualities for adaptive bitrate streaming.

It would be nice if "desktop" browsers all supported HLS and H.264/AAC natively, that would be a real Flash killer.

endianswap• 11 years ago

Yes except if you want 1080p60 you just won't be able to use Flash because even on fast computers the CPU overhead is killer.

TD-Linux3• 11 years ago

You're right, live video without Flash is not nearly as advanced. However, there are several options that work right now:

- Plain old HTTP WebM stream. Only one resolution, but it works. - MPEG-DASH - very similar to HLS, but implementable in Javascript via MSE APIs in browsers today. - WebRTC - low latency streaming, in some cases it might make sense to use this over MPEG-DASH even for one-to-many streaming cases, like interactive lectures and the like.

Unfortunately several browsers lag behind in implementing the required APIs, so this does not solve all problems yet. But the problem isn't creating any new protocols, it's just getting adoption.

As for H.264, it's mostly a solved problem with hardware decoders and OpenH264 (currently not used for <video> playback, but could be). AAC, however, costs more to license and is much more problematic, so there will always be some browser vendors that don't ship it.

stinky613• 11 years ago

It seems like some B2B software vendors use it to keep people from seeing/manipulating their frontend code in web-based applications.

therealmarv2• 11 years ago

Is there any Flash security bug recently which makes it outside the Chrome sandbox?

steveax• 11 years ago

Yep, the one that became public 5 days ago [1]

[1] https://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-t...

bitmapbrother5• 11 years ago

Only when used in tandem with a Windows exploit:

"A spokesperson for Google confirmed that attackers could evade the Chrome sandbox by using the Flash exploit in tandem with another Windows vulnerability that appears to be unpatched at the moment."

TD-Linux3• 11 years ago

The Chrome sandbox isn't as strong as you might think. Flash needs access to a ton of stuff to work: - Camera / Microphone - Filesystem - GPU So there's plenty you can do without escaping the sandbox.

sobkas6• 11 years ago

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

fnordfnordfnord• 11 years ago

If they say much of anything, they will probably just reiterate that they take security very seriously.

elorant• 11 years ago

Their clientele isn’t security wary people. Plus they don’t have any serious competition in most of their products so it can’t hurt them either way. So they’ll probably issue a generic statement and move on with their lives.

As for consequences, the best thing most of us could do is disable Flash from the browser. I’ve done it since YouTube defaulted to HTML5 video and never looked back since.

dguido5• 11 years ago

You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part).

If you're running an update to date flash, that means you're probably running it in a sandbox and probably have silent auto updates turned on. That's good enough for most people.

If you're the kind of person that's going to get specifically targeted, then you should not only reconsider running flash on your computer, but any other program written in an unsafe language.

Or, you know, segregate your data.

al2o3cr• 11 years ago

"You think that any other software you use is any better?"

I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr...

To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.

beedogs• 11 years ago

Flash gets it rough because it's horribly-written software full of security holes. It's demonstrably worse than most anything else out there.

kijin• 11 years ago

Flash "auto updates" are anything but.

On Windows, you get a pop-up to update manually, which just sends you to their website so you need to download and run the installer by yourself.

If you don't update manually, Flash will wait 45 days before triggering an automatic update. I never waited that long, so I don't know whether it's "silent" or not.

DavideNL4• 11 years ago

i'm not sure if it's relevant whatever they'd have to say.

Just look at the news for the past years and there's only 1 conclusion: uninstall Flash or accept increased risk of catching a virus.

pjc50• 11 years ago

If there were actually a government body that cared about "cyber"-security, they'd be hauled up in front of it. They're basically an infosec Bhopal - creating a toxic mess that other people have to clean up over a period of decades.

digi_owl• 11 years ago

In essence there are not critical US systems running on Flash and so the defensive side of NSA don't care. And the offensive side is just happy to let it rot, as that means more opportunities for them.

akshatpradhan• 11 years ago

They're basically an infosec Bhopal

I lul'd.

astrodust2• 11 years ago

Can we get Adobe declared a Superfund clean up site?

bitmapbrother5• 11 years ago

Should we also ask what Microsoft has to say about their consistent streak of serious security problems in IE and Windows?

dchest• 11 years ago

How about making police raid homes and forcefully uninstall Flash Player?

Buge2• 11 years ago

Why waste money on police raids when you can exploit Flash to put "malware" on their computer that uninstalls Flash?

ytdht• 11 years ago

you probably can lookup news archives of the last ~15 years for that

thomasrossi2• 11 years ago

:) I was at a security meeting, I've heard the same reply. I am really not sure why it's still so used though.

mahouse3• 11 years ago

What? I mean, how is this news?

sobkas6• 11 years ago

What is news?

mahouse3• 11 years ago

Isn't the record of infinite vulnerabilities in Flash widely known by everybody?

curiousjorge• 11 years ago

does Chrome and Firefox automatically update the Flash? I can't turn it off because...well lot of video sites made for men that are not Youtube or Twitch but more popular than Vimeo ever will be, requires flash.

DavideNL4• 11 years ago

Google Chrome - yes, it has Flash built-in.

Firefox - "no", it doesn't have Flash built-in but uses Flash installed in the operating system. However, Flash installed separately for example in Windows/OS X also updates itself.

However, you are screwed either way: always running the latest Flash player version which is known to be constantly full of security bugs, just like in the past 3 years... :)

leni536• 11 years ago

Use youtube-dl, or mpv with youtube-dl. It can fetch videos from many adult sites without using flash.

chinathrow2• 11 years ago

https://twitter.com/BrendanEich/status/619876135623618560

stevenh• 11 years ago

My Macbook kernel panics and force-reboots itself because of a bug in some newer Firefox browser feature(s) which are used by a JS-based GBA emulator which was trending on HN yesterday. I can consistently duplicate the kernel panic by resizing the browser window while the emulator is running. I've never in my life experienced such a catastrophic bug from a Flash demo.

At worst, such a devastating bug has a decent chance of harboring its own RCE which has yet to be discovered or disclosed; at best, it's one of the most extreme local DOS attacks that a webpage could possibly launch against a client.

Just because it's much more trendy to bash Adobe than it is to bash Firefox doesn't mean that Firefox's problems are nonexistent.

Firefox RCE found on January 20, 2015: https://community.rapid7.com/community/metasploit/blog/2015/...

Firefox RCE found on February 25, 2015: https://msisac.cisecurity.org/advisories/2015/2015-018.cfm

Firefox RCE found on March 1, 2015: https://www.mozilla.org/en-US/security/advisories/mfsa2015-3...

Firefox RCE found on April 22, 2015: https://msisac.cisecurity.org/advisories/2015/2015-046.cfm

etc.

Pot calling the kettle black.

__david__• 11 years ago

I you are panicking the kernel, that is a kernel bug, not a JS/Firefox bug.

Animats• 11 years ago

Flash is decades old, not that big, and still has use-after-free vulnerabilities? Tools for catching those have been widely available for years. That makes one suspect those vulnerabilities aren't there by accident.

We need public disclosure of the code check-in that created the bug, with names. People need to be fired for this.

ceejayoz4• 11 years ago

Flash is big - video, audio, animation, browser hooks, filesystem access, etc. - and while Flash has been around for decades the code in the current iteration mostly hasn't been.

sobkas6• 11 years ago

Being big is not an excuse for being terrible at security. If they can't secure a big thing, then maybe they should stop building them so big?

wmt2• 11 years ago

Work on a massive decades old software project and get ready to have your eyes opened. All the automated static and dynamic software analyzers catch only the easiest flaws, but can catch the more serious ones only if you're skilled and lucky.

Firing people for software bugs is the stupidest thing I've heard in a while. Everyone writes horrific software flaws. Everyone. The best of the best programmers just write less of them. Firing people for bugs is a job perk that will only motivate any good developers to find a less stupid employer as soon as possible.

PhantomGremlin2• 11 years ago

All the automated static and dynamic software analyzers catch only the easiest flaws

In a 64-bit environment, at least for development purposes, why can't every single malloc() cause an allocation from new memory page(s)? Then free() removes the page(s) from accessible virtual memory.

Too much overhead for production, but it would sure catch a lot of use-after-free bugs during development. Is nobody doing something like that, or is that part of what you consider "the easiest flaws"?

PhantomGremlin2• 11 years ago

People need to be fired for this

This comment was heavily voted down a day or so ago (not by me, I voted it up). But just now I'm reading about yet another zero-day, this time against Java.

So the question is, when are we going to get disgusted, sick and tired of all this sloppy code? When will "heads will roll for this" revert to being a meaningful punishment instead of just a historic cliche?

Enough is enough! If there are no consequences there will be no improvement.

1019142• 11 years ago

For me there are generally 3 steps to the process of watching a youtube video.

1. Get the video id. Retrieve HTML containing youtube /watch?v= urls or other urls that contain the video id. Extract the urls from the HTML or other markup garbage.

2. Retrieve the video. Feed the /watch?v= url to a script that does some "find and replace" on the absurdly long googlevideo urls. Below I have given an example of such a script. Complaints welcome. It takes a /watch?v= url on stdin and retrieves the video in the format specified on the command line.

3. Play the video. ffmpeg libraries, mplayer, etc.

Whatever it is Flash does in the process of watching youtube videos (I am quite sure it is not step 3), I do not need it.

Thus even if by not using Flash or a complex "modern" web browser to watch youtube videos somehow were to reduce my exposure to vulnerabilities that routinely occur in such software, I would not care. Because the reason I do not use Flash is.... because I do not need it.

   # proof of concept: video retrieval
   
   # requirements:
   # sh, sed, tr, openssl, ftp
   
   # Adobe Flash not required
   # HTML5 not required
   # Python not required
   # Awk not required
   # web browser not required
   
   
   curl=ftp 
   file=1.mp4 # default outfile 
   url=www.youtube.com # example
   
   
   # itag #s are on the wikipedia page for youtube
   
   
   
   f061(){
   sed '
   s,%3D,=,g;
   s,%3A,:,g;
   s,%2F,/,g;
   s,%3F,?,g;
   s/

//g; ' }

   f060(){
   sed -e '
   s/&itag=5//;t1
   s/&itag=1[78]//;t1
   s/&itag=22//;t1
   s/&itag=3[4-8]//;t1
   s/&itag=4[3-6]//;t1
   s/&itag=1[346][0-9]//;t1
   ' -e :1
   }
   
   f062(){
   sed '
   s,http,\
   &,g' 
   }
   
   f063(){
   sed '
   /%3A%2F/!d;
   /videoplayback/!d' 
   }
   
   f064(){
   sed '
   s,%26,\
   ,g;
   s,&,\
   ,g;
   ' 
   }
   
   f065(){
   sed 's/&https/\
   \
   https/g;' 
   }
   
   f066(){
   sed 's/\\u0026.*//' 
   }
   
   f067(){
   sed '/itag='"${1-.}"'/!d;' 
   }
   
   f068(){
   sed 's/%25/%/g' 
   }
   
   
   f069(){
   tr '\012' '&' 
   }
   
   f070(){
   sed 's/&$//'; echo 
   }
   
   f071(){
   local a061 a062 a063;
   while read a; do 
   case $a in 
   https://*)a061=${a#https://*/} ;; 
   http://*)a061=${a#http://*/} ;; 
   *)a061=${a#*/} ;; 
   esac; 
   a062=${a#*://}; 
   a063=${a062%%/*}; 
   printf "%b" "${1-GET} /${a061} HTTP/1.0\r\n" 
   printf "Host: ${a063}\r\n";
   printf "User-Agent: GoogleAnalytics 1.5.1\r\n";
   printf "Connection: Close\r\n";
   printf "\r\n";
   done;
   }
   
   f072(){
   openssl s_client -ign_eof -connect $1:${2-443} -verify 9 
   }
   
   
   
   
   
   
   
   case $# in
   [12])
   {
   f071 \
   |f072 $url \
   |f062 \
   |f063 \
   |f061 \
   |f060 \
   |f064 \
   |f068 \
   |f069 \
   |f070
   } \
   |f061 \
   |f065 \
   |f066 \
   |f067 $1 \
   |{ 
   read a;
   exec $curl -4o ${2-$file} $a ;
   }
   
    ;;
   *)
   exec echo \
   "usage:   $0 itagno [outfile]
   outfile: $file"
   esac

abandonliberty• 11 years ago

If you're on windows SVP has a youtube extension that does this and plays it at 60fps :)

https://www.indiegogo.com/projects/real-time-video-frame-rat...

minitech• 11 years ago

Why are your functions named with numbers and why aren’t you using youtube-dl (https://rg3.github.io/youtube-dl/)?

rasz_pl• 11 years ago

holy crap that is convoluted

I simply use mplayer and javascript oneliner extracting direct mp4 link from YouTubeCenter plugin = streaming video in mplayer without downloading.

1019142• 11 years ago

Q: "... why aren't you using youtube-dl?"

A: "holy crap that is convuluted"

I do not use Python nor a Javascript-enabled web browser to download video.

Both are big, convoluted, slow(!) and unnecessary.

But I do agree with using mplayer for playback.

hobarrera3• 11 years ago

0-day exploits? I though that flash had been discontinued years ago.

The last release I've found is 11.2, which seems to be years old and the last ever.

Buge2• 11 years ago

http://www.adobe.com/software/flash/about/

hobarrera3• 11 years ago

Huh, I hadn't researched this before, but it looks like flash for Linux has been frozen for years, while the windows and OS X releases keep getting updates.

So I guess Linux users are immute to this new zero-day?

thrownaway2424• 11 years ago

What are the people doing now who formerly developed Flash? Are they all diesel mechanics and baristas or what? I wouldn't even considering calling back a candidate why had Macromedia on their work history.

scrollaway• 11 years ago

I wouldn't even considering calling back a candidate why had Macromedia on their work history.

And I wouldn't even sort of consider hiring or even working with anyone that thinks work experience in a language makes them a liability.

someguy1233• 11 years ago

Important PSA for Skype Users: Open up "Internet Options" (yes, the ones in internet explorer), security tab, and add https://apps.skype.com to the "Restricted Sites" list. Skype will still work fine, however there will be no advertisements.

This is important because Microsoft seems to use a lot of Flash advertisements without checking them (I've had plenty of "MICROSOFT VERIFIED DRIVER FIXING" ads come up inside of Skype, so I'm sure some zero day could slip though their ad system)

aptwebapps• 11 years ago

Skype on Windows has ads? Is that a recent thing? The Mac version doesn't, or not yet, anyway.

brobinson• 11 years ago

It's had ads for at least two years now. That was the last time I used it on Windows.

astrodust2• 11 years ago

The OS X version now has ads, but only on certain pages. Highly annoying. This was one of the historical differentiators.

chm2• 11 years ago

If you want to do this on a Mac you can use software such as Little Snitch. Create a rule prohibiting Skype to connect to apps.skype.com.

Two more Flash 0-days emerge in Hacking Team leak

Related Stories