Flash Accounted for All Top 10 Vulnerabilities Used by Exploit Kits in 2015

[Batu69]

Java vulnerabilities were ignored almost entirely

In the past year, exploit kit makers have switched from targeting Java security flaws to exclusively exploiting weaknesses in the Adobe Flash Player, a recent report from the NTT group shows.

The security firm claims that all of the top 10 vulnerabilities targeted by exploit kits during 2015 were Flash flaws. According to historical records kept by the NTT Group, 2015 was the first year when exploit kits used more Flash flaws compared to Java, which almost disappeared from exploit kits altogether.

This change in trends comes after Java was 2012, 2013, and 2014's most targeted technology via exploit kit vulnerabilities. Besides Flash, in 2015, the second and third most targeted technologies were Internet Explorer and Microsoft Windows.

The reason behind this trend is because of the massive security updates Java received in 2014 which made exploitation much difficult. Hackers turned their focus on Flash, which saw four zero-days in 2015 only from the Hacking Team data breach alone.

Symantec also recorded a high number of Adobe Flash zero-days

A similar report released by Symantec two weeks ago also confirms this trend. Symantec says that Flash vulnerabilities accounted for 17 percent of all zero-days in 2015, with four of the top five most used zero-days in 2015 belonging to Flash.

With so much material to work with and with Java's extremely hard-to-bypass security features and dwindling market share, it is to no surprise that Flash usage in exploit kits has grown so much.

The security upgrades that contributed to Java's downfall from exploit kit arsenals are the click-to-play feature and Oracle's decision to block unsigned applets by default.

In order, the top 10 Flash vulnerabilities used in exploit kits last year are as follows: CVE-2015-0311, CVE-2015-5119, CVE-2015-5122, CVE-2015-0359, CVE-2015-0313, CVE-2015-2419, CVE-2015-3090, CVE-2015-3113, CVE-2015-0336, CVE-2015-7645, and CVE-2015-3105.

For more details on exploit kits and other security topics, you can download NTTs 74-page 2016 Global Threat Intelligence Report.

Article source

[pc71520]

Flash must be banned.

[flash48]

If you must have Flash then, set it up with 'Ask to activate', as opposed to 'Always activate'  This is what I have done.  It gives me complete control when it runs.

[DKT27]

Some addons available for browsers to use HTML5 on video sites. People should use them.

[steven36]

12 hours ago, DKT27 said:

Some addons available for browsers to use HTML5 on video sites. People should use them.

The current HTML5 addons  only support

Youtube, Facebook, Vimeo, Dailymotion, Break, Metacafe.

 

Most all sites that have  HTML5 you can make them  work without a addon by just not installing flash or turning  it off  in Firefox .

 

I use Plugins Toggler  addon and just use flash when its needed . I keep it turned  off 90%  of the time,   there's still many sites were dont support  HTML5. that's why chrome still have pepper  flash even.

 

I use Watch with MPV  addon  a lot  as well and stream though MPV  player  it works for more sites than HTML5 does .