Adobe will try to stymie some Flash attacks with new pop-up
Flash 11.6 to block automatic play of content in docs created with Office 2007 and older
Computerworld - Adobe last week announced it would add a new security feature to Flash Player in an attempt to block some of the exploits hackers are hiding inside older Microsoft Office documents.
The new feature -- a pop-up warning -- will be triggered when Flash Player detects Flash content inside documents created with Office 2007 and earlier versions.
Currently, Flash content embedded in documents crafted with Office 2007 and its older siblings, Office 2003 and Office XP, executes automatically on Windows PCs. That's a characteristic hackers have long abused, something Adobe acknowledged.
"Since...November 2010, the most common Flash Player zero-day attack vector has been malicious Flash content embedded in Microsoft Office documents and delivered via email," said Peleus Uhley, a platform security strategist, in a Feb. 7 post to the Adobe Secure Software Engineering Team (ASSET) blog.
Uhley also noted that the latest round of zero-day vulnerabilities in Flash -- ones criminals are already using by the time bugs are patched -- were being exploited with that tactic.
Adobe updated Flash Player on Thursday to fix the critical flaws.
To make Office document-based attacks more difficult, documents generated with Office 2007, 2003 and XP -- Microsoft dropped the latter from its support list in mid-2011 -- will no longer auto-execute Flash content. Instead, when documents created with those suites are opened, Flash will display a dialog recommending the user not let the content play.
Users can select a second option and play the Flash content if they're certain the document came from a trusted source.
Flash won't bother showing the pop-up for documents generated with newer versions of Office, including Office 2010 and the just-released Office 2013, because those suites sport a sandbox that prevents automatic play of Flash content.
Microsoft calls its Office sandbox "Protected View," a feature introduced in Office 2010 and continued in Office 2013. In both suites, Word, Excel, and PowerPoint files are opened in a sandboxed, or isolated, instance of the application when the file was downloaded from the Internet or opened as an Outlook email attachment.
Microsoft did not back-port the Protected View sandbox to older editions of Office.
Adobe's Uhley did not promise that the new dialog would stop Flash exploits embedded in Office documents, but was instead simply crossing his fingers. "We've seen these types of user interface changes lead to shifts in attacker behavior in the past, and are hopeful this new capability will be successful in better protecting Flash Player users from attackers leveraging this particular attack vector as well," he said.
Utley did not provide a timetable for when the security pop-up feature would hit Flash Player, saying only that it would appear in the next "feature release" of the software, "which is currently in beta."
Flash Player 11.6 is the version now in beta testing.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is email@example.com.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!