In the wake of last week’s Hacking Team breach, two more critical flaws in Adobe Flash have been discovered, which has rekindled the debate over its security integrity. Facebook’s new chief security officer, Alex Stamos, has now called for an end to Flash.
Tweeting over the weekend, Stamos called on Abode to set an “end-of-life” date for Flash, “even if, 18 months from now, one set date is the only way to disentangle the dependencies and upgrade the whole ecosystem at once,” he added.
It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day.
— Alex Stamos (@alexstamos) July 12, 2015
Last Friday, Adobe released a security bulletin that detailed new vulnerabilities through which an attacker could gain control of a victim’s computer. It affects Windows, Mac, and Linux users.
Flash’s security has always been a hot topic. Steve Jobs once famously decried its security. He had taken umbrage with Flash and felt it would compromise Apple’s devices. “We don’t want to reduce the reliability and security of our iPhones, iPods, and iPads by adding Flash,” he said five years ago. To this day Flash isn’t pre-installed on Apple products.
Noted security blogger Graham Cluley echoed Stamos’ remarks, but added that Adobe is unlikely to heed this advice.
“The truth is that the company would probably gain a lot more respect from the Internet community if it worked toward this ultimate fix for the Flash problem, rather than clinging on to the belief that it might be able to one day make Flash secure,” he said.
Security issues with Flash have constantly dogged Adobe. Just last month it pushed out another security advisory following the discovery of a bug that would, once again, allow an attacker to gain control of a computer.
Despite these concerns, Adobe has maintained Flash and regularly patches and updates it. Last month, it was praised for responding to vulnerabilities with patches within 24 hours.
However last week’s hack on Hacking Team — which saw a 400GB cache of sensitive data hit the Web — was a different kind of threat. The firm has been accused of supplying surveillance technology to repressive governments.
Zero days — previously undiscovered and unpatched vulnerabilities that can be invaluable to hackers as no one else yet knows about them — were found among the data. It has caused great consternation in the security community given the type of work that Hacking Team was allegedly facilitating, if standard patches would be enough, and if any more Flash threats will emerge from the breach.
