Major Adobe Flash security flaw discovered

[eznutz]

Software maker Adobe says it is fixing a critical flaw revealed by the spectacular attack on Italian surveillance company Hacking Team.

Sunday’s breach sent over 400 gigabytes of Hacking Team’s internal data coursing into the public domain, some of which was posted to the company’s Twitter account briefly. According to The Verge, one tweet appeared to show an email from Hacking Team CEO David Vincenzetti mocking a competitor for being “severely hacked.”

Although the focus has largely been on the Milan-based company’s email correspondence, Hacking Team also appears to have lost control of the surveillance software used to spy on its targets.

Security researchers say malicious actors have wasted little time in looting the stricken company’s electronic arsenal and are now adopting Hacking Team’s tools for their own attacks.

http://globalnews.ca/news/2098997/major-adobe-flash-security-flaw-discovered-in-hacking-team-leak/

 

[JohnHenry]

Stupid people, thought they were so good they missed the basics. Didn't even isolate their precious source code from the internet.

 

[The Options Menu]

Stupid people, thought they were so good they missed the basics. Didn't even isolate their precious source code from the internet.

It sounds like the "hackers" got the whole contents of the "strategic intelligence firm's" primary storage... Much of the best code is available under open source licences on the internet as it is, and many eyes helps make all bugs shallow. It sounds like this group got the whole drive. The REAL problem is governments and private firms stockpiling security vulnerabilities as strategic weapons as opposed to reporting them. There are private methods of doing this for most projects / software of note. If one group finds a security hole, it means others can... The ironic thing is that these people got breached by other people doing the same thing that they were, and these people apparently got root / admin on their primary storage, which is why backdoors and stockpiling bugs are truly horrible ideas if you fancy yourselves 'the good guys'.

It's one of the better illustrations of why 'the ends justify the means' is a horrible idea in most cases.

 

[Hard Idle]

I've just been alerted to a "critical update" for Flash" ver. 18.0.0.203" is this meant to address the problem?

 

[The Options Menu]

I've just been alerted to a "critical update" for Flash" ver. 18.0.0.203" is this meant to address the problem?

I would assume so, now that the exploits are out in the wild it should get fixed quickly. (Assuming Flash is currently supported on your device / OS.) If you can get away with it you do well to uninstall Flash, or set it to 'click to play'... Especially if you surf random porn...

 

[Hard Idle]

or set it to 'click to play'...

What exactly does this do (or prevent)?

Does this exist in a Settings menu or does it require a custom installation?

 

[stanleyross]

A good web site to follow this topic
http://krebsonsecurity.com/

 

[Frankfooter]

It is quite ironic that 'Hacking Team' was hacked.
They provide hacking software to despots everywhere.

https://firstlook.org/theintercept/2015/07/08/hacking-team-emails-exposed-death-squad-uk-spying/

 

[The Options Menu]

What exactly does this do (or prevent)?

Does this exist in a Settings menu or does it require a custom installation?

Under a browser like Firefox, you can go into 'Add Ons' and set Flash to only play when you click on it. Many browsers have an equivalent.

The world's shortest and laziest security advice is this:
1. Do your updates on everything, including things like routers, and set them to be done automatically if you can.
2. Get rid of any browser plugin you can, and set as many of the browser plugins that remain to 'click to use' as possible.
3. Remove software that's crapware, or you don't use.
4. Break up as much of the 'old trinity' as you can. That is Windows, IE, and Office, though other OSes and software are certainly targets as well.
5. Never connect your gateway device (Modem) directly to your computer. Always have a routing device in the middle so your computer doesn't have software listening on ports directly exposed to the internet.
6. If you don't intimately know every service running on a piece of hardware have a firewall.
7. If you use files from any outside source, including work and P2P, have a virus scanner (Even on OSes that don't have a lot of viruses. Think of the next person.).
8. Make sure any clean up tools you use are from a known source, and are preferably for offline use.
9. If you use P2P, or public Wifi, invest in a VPN.

After that you're pretty much in the realm of 'really serious security needs'.