Adobe Flash zero-day exploit... leveraging ActiveX… embedded in Office Doc... BINGO! Stop us if you've heard this one before: An Adobe Flash zero-day vulnerability is being actively targeted in the wild to hijack victims' Windows PCs. Researchers with Gigamon Applied Threat Research (ATR) and Qihoo 360 uncovered a phishing campaign that exploits CVE-2018-15982, prompting Adobe to today release an out-of-band …
what it says in the title.
AAAARRRRRGGGGHHHH!!!!!
(yeah it's a bit like Charlie Brown and Lucy Van Pelt and the football... the only way to win, is NOT to play)
And *STOP* accepting e-mailed "office format" documents at the firewall!
icon, because, facepalm.
it's not like these 3 security craters haven't been KNOWN for DECADE(s).
Yeah, but we have so much legacy flash/office stuff that our business depends on, we cannot just turn it all off.
We are too dumb to plan migration to a secure policy. We just have to learn and not do it again. This time we really will learn, we really believe that.
Except, we are still as dumb as Charlie Brown when it comes to being suckered one more time.
BTW, it's spelled AUGH!
The problem is, some VP really needs that email from "Doctor@hospital.com" with a document titled "IMPOTENT:
A shame, and end to his bloodline maybe, but not the end of the world - some of us don't get the opportunity to have offspring in the first place.
Nah, Word has a section called "developer" and in it are a whole selection of activeX non-goodies. I regularly receive embedded MS docs from an evilcorp that thinks it is the ballon de chien at security... cockwombles.
Bob, I've always wondered why Charlie didn't get sick & fekkin' tired of Lucy's constant bullshit with the ball, decide to get even for a change, & ignore the ball to kick her in the ass instead. Laugh as she screams a nice high arc over the goal posts, throw up the arms in classic Spanish soccer announcer delight & scream "GOAL!" at the tops of his lungs.
But then I also wondered why Linus didn't pause in his piano playing at Lucy's interruption, tell her to fek off, then slam her nose in the key cover when she refused to leave him alone. "Listen bitch, the blade cuts both ways & NO MEANS NO! Go away! You're a bitch! Die already you cockwomble! AAAAHHHHH!"
*Cough*
I never did like that girl... =-Jp
Thanks for this very stark warning. As an 'adviser' to foreign students studying at UK Universities, I have become used to receiving significant volumes of MS Word documents, like theses, containing multiple media types. Is there a practical alternative? If not, what effective precautions can be taken?
I have become used to receiving significant volumes of MS Word documents, like theses, containing multiple media types. Is there a practical alternative?
I tend to open external docs with LibreOffice - it's about the strongest argument to have at least an install on the PC (and, let's face it, it doesn't burn a hole in the IT budget either).
If not, what effective precautions can be taken?
Start with killing off anything "automatic". Do some surfing, plenty of advice out there.
And get rid of Flash. Just do it.
"If not, what effective precautions can be taken?"
-------------------------------------------------------------------
Run Linux with LibreOffice as your office suite, and a suitable email client (such as Thunderbird, though there are other choices) that includes support for PGP signing and encryption.
Run necessary windows programs in wine, or if that won't work, a VM.
Always run from a user level, nonprivileged account.
Keep the software updated. Personally I like a rolling release for this, but you can use a point release and still be orders of magnitude better off, with perhaps a bit more stability, though proper testing should keep a point release distribution working reliably too. Just don't upgrade everything in a the first week, except for 'hot' vulnerabilities.
Always validate hashes on software.
Run antimalware including antivirus and a web page scanner.
Lock down default browsers with things like uBlock or NoScript.
If something absolutely needs to be run, and run on Windows, run it in a VM.
If you are concerned about a site, or particular data, access via a locked down Linux in a VM - possibly a read only distribution - and be ready to delete that VM and replace it with a clean backup.
When feasible, use software in a VM to strip data down to macro free text files for documents and spreadsheets before moving to a filesystem accessed by your primary OS instance.
Block ads and trackers with Ghostery, PrivacyBadger, and the like to reduce attack surfaces.
Always run a VPN for anything outside your local network, or even on your local network, both to protect data and privacy and to reduce attack surfaces.
Never connect to any network you or your competent IT staff do not control, without a VPN.
When in doubt use a bootable read only Linux distribution.
When travelling remove your HDD, and carry two or three Linux DVDs for appropriate uses (Tails, Knoppix, and Mint would be a good toolkit). Use the most restricted choice for your current task. Carry your data on a flash drive or SD card, encrypted with a travel only key. If need be, store the key on a secure internet accessible location, encrypted with a passphrase written down at your home or office, and nowhere else. Do not take the key across borders. Do not use your travel computer except while travelling (which means you could re-use the HDD elsewhere).
ActiveX? Again. A ridiculously stupid idea from the outset... as in cobbling together one layer of dangerous instability on top of another layer of dangerous stupidity on top of another layer of dangerous stupidity?
Combine with Flash? Seriously? The most insecure mess since, erm, anything else that came out of Adobe. Or Microsoft. or possibly Sun.
What's the commonality in this mess? Largely unnecessary proprietary extensions in place of standards. It's not that standards based systems are invulnerable (far from it) but their legacy is much less. And they can be fixed. ActiveX can never be fixed - ban and block it. Flash almost certainly can never be fixed either. As for the other insecure stuff that comes out of Adobe, as in a document format (PDF reader) that suddenly "needs" Flash, JavaScript (homebrew abortion version of course) and local system access to all kinds of unnecessary resources... just no. No. never.
Which either require flash to be working, or use it as an unavoidable plugin in the browser.
Americans are quite trigger happy when it comes to punishing people guilty of repeated offenses, I don't understand why everyone working at Adobe is not in jail, together with a restraining order for coming close to any computing device.
There is a Flash-free version of VMware vSphere now, and it’s substantially less clunky, too. (But, yes, why an admin interface for sysadmins, and often used from less, pardon the pun, flashy unix workstations was built around Flash in the first place is somewhat mind-boggling.)
Another security fail from MS and Adobe. Why is Active-X even switched on by default since it pretty much died when IE? The 1% of people that actually need Active-X on should have to enable it rather than it be a gaping hole ready to be exploited by any bad actors.
As for Flash, DIE, DIE, DIE! I wish Google would remove Flash support from Chrome, as this would force those developers who are hanging on to it to finally do something about moving to HTML5. Or risk the majority of users not being able to access their websites.
...I had an engineering ethics text years ago that had a comic poking fun at some issues we had in the 1970's:
...A DC-10 airliner full of Firestone 500 tires loses an engine and crashes into the Three Mile Island nuclear power plant. The resulting fire is put out using asbestos blankets...
ActiveX + Flash + MS Office ... same damned thing.
In my workplace, which is so far from the cutting edge of technology that we can't even see the handle, we have a device which requires Flash for remote access... and of course, the people selecting this device claim to NEED remote access.
We also have a device which uses Java... but not any of the new versions, this requires Java from, as I recall, six or seven years ago. Thank goodness for archives of old versions of Firefox (and Portable Apps, so it doesn't interfere with newer versions)! This device does not have a physical control panel, and as far as we can tell there will be no updates to the firmware ("Buy our newer hardware, which is more expensive and not suited to your needs").
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
