Yet again, Adobe’s Flash plugin has been hit by a “zero-day” exploit, meaning that even users with a fully up-to-date installation of the software are vulnerable to attacks.
Hackers exploiting the vulnerability can install software on users’ computers against their will, and at least one group is doing just that, according to security researchers at Trend Micro.
The hacking campaign began with phishing emails sent out using subject lines such as “Syrian troops make gains as Putin defends air strikes” and “Israel launches airstrikes on targets in Gaza”. Those emails contain links to websites hosting the exploit, and so when a user with flash installed clicks on the link, the malware is installed on their computer.
The vulnerability is just the latest in a long string of weaknesses from Flash. In July, the company was forced to issue an urgent patch after another zero day vulnerability came to light following the hack of hackers-for-hire Hacking Team; and in June, Adobe barely beat the bad guys to the punch, issuing a patch for another critical weakness just days before it began being exploited by hackers in the wild.
As a result, the news has led to renewed calls for users to uninstall Flash.
How to patch flash 0-day: 1) Uninstall flash 2) You don't need flash 3) Stop installing flash
— MalwareTech (@MalwareTechBlog) October 13, 2015
The plugin, once single-handedly responsible for the rise of online video, has been showing its age in the era of mobiles. The iPhone, which has never supported Flash video, has been the catalyst for an increasing number of sites dropping support.
In January this year, YouTube announced it would stop serving videos using Flash to anyone with a browser that supported modern streaming technology. And in August, Amazon announced it would block the use of Flash in advertising on its sites.
• Flash is dying a death by 1,000 cuts, and that’s a good thing
