Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two more Flash 0-days emerge in Hacking Team leak

theregister.co.uk

Post reply on HN
Print view View original

111–120 of 193 posts

Re: Two more Flash 0-days emerge in Hacking Team leak

#111

Post by TD-Linux »

sethd wrote: post #74
dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

I can think of one use case where Flash still makes sense: Live video A lot of people seemed to be surprised this is the case but tell me what single live streaming protocol is supported across all browsers without a plugin? With Flash you can stream HLS (HTTP Live Streaming) to a Flash player in full browsers while just directly loading the same HLS playlist in mobile browsers via native players (iOS / Android). Thi…

You're right, live video without Flash is not nearly as advanced. However, there are several options that work right now:

- Plain old HTTP WebM stream. Only one resolution, but it works. - MPEG-DASH - very similar to HLS, but implementable in Javascript via MSE APIs in browsers today. - WebRTC - low latency streaming, in some cases it might make sense to use this over MPEG-DASH even for one-to-many streaming cases, like interactive lectures and the like.

Unfortunately several browsers lag behind in implementing the required APIs, so this does not solve all problems yet. But the problem isn't creating any new protocols, it's just getting adoption.

As for H.264, it's mostly a solved problem with hardware decoders and OpenH264 (currently not used for playback, but could be). AAC, however, costs more to license and is much more problematic, so there will always be some browser vendors that don't ship it.

Re: Two more Flash 0-days emerge in Hacking Team leak

#112

Post by TD-Linux »

degenerate wrote: post #37
sebcat wrote: post #10

Earlier quoted context omitted.

I've been running without Flash for a couple of years now. The only thing I can't do that I would like to be able to do is to watch Facebook videos. Other than that, not having Flash installed is not a problem for me.

Facebook doesn't use HTML5? Why?!

They will if you force a mobile user agent. I wish I knew why they didn't on desktop.

Re: Two more Flash 0-days emerge in Hacking Team leak

#113

Post by TD-Linux »

therealmarv wrote: post #17

Is there any Flash security bug recently which makes it outside the Chrome sandbox?

The Chrome sandbox isn't as strong as you might think. Flash needs access to a ton of stuff to work: - Camera / Microphone - Filesystem - GPU So there's plenty you can do without escaping the sandbox.

Re: Two more Flash 0-days emerge in Hacking Team leak

#114

Post by BatFastard »

JoshTriplett wrote: post #59
x0x0 wrote: post #58

Earlier quoted context omitted.

Why don't you 100% blame the people at fault: Adobe / the original developers. First, they were incompetent enough to not correctly develop their software. Second, non-assholes would have a standing price-match policy for bugs. Adobe should give you 110% of the highest bid you get for any 0-day. They could have fixed these a long time ago if they'd paid the discoverer $45k (or $150k -- times three for exclusivity.) T…

Bug bounties are sensible, but price-matching seems too easy to game. How can the company know a bid is serious, and not just fake to be matched? "Oh, sure, so-and-so offered $200k for this bug." (For that matter, while reputation is certainly a thing, what stops a security researcher from selling the same 0-day to several different buyers, and then selling it to the company to fix? Do the typical contracts to sell 0…

How about an escrow contract using a third party and bitcoin? You could call it silk road 3 Its really not that hard to be taken for a ride if you have the resource adobe does.

Re: Two more Flash 0-days emerge in Hacking Team leak

#115

Post by DrJokepu »

chippy wrote: post #70
DrJokepu wrote: post #49

Earlier quoted context omitted.

Twitch works just fine with HTML5 these days, including chat.

How do you get the video to play with HTML5?

Works out of the box on Safari 8 with no Flash installed.

Edit: proof: http://i.imgur.com/myfsoNv.png

Re: Two more Flash 0-days emerge in Hacking Team leak

#116

Post by cpeterso »

shimfish wrote: post #42
archgoon wrote: post #9

Earlier quoted context omitted.

A lot of advertising networks use it to deliver advertisements. Whether it is simple inertia at this point, or because the networks can get a better fingerprint using flash, I don't know. Also, it used to be the case that Flash had better DRM controls on it, but I'm pretty sure that reason is no longer the case since Encrypted Media Extensions got rolled out. However, that doesn't explain why Facebook's on-site video…

Facebook appears to have moved to an html player in the last few days.

Facebook currently only supports HTML5 video for Windows 7+.

Re: Two more Flash 0-days emerge in Hacking Team leak

#118

Post by Wizzard666 »

sobkas wrote: post #23

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

It hurts to think about how many people have been financially fucked over due to Adobe software practices

Re: Two more Flash 0-days emerge in Hacking Team leak

#119

Post by ninkendo »

archgoon wrote: post #9
dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

A lot of advertising networks use it to deliver advertisements. Whether it is simple inertia at this point, or because the networks can get a better fingerprint using flash, I don't know. Also, it used to be the case that Flash had better DRM controls on it, but I'm pretty sure that reason is no longer the case since Encrypted Media Extensions got rolled out. However, that doesn't explain why Facebook's on-site video…

The advertising networks being the last to use it is something that will make Flash's implosion very quick and sudden, IMO.

If uninstalling flash only causes you to miss out on ads, it makes uninstalling flash that much more attractive. Which makes the advertisers want to get off flash that much sooner.

It needs probably just one or two more use cases to disappear (Facebook video is one of them), and its final death will be quite quick.

Re: Two more Flash 0-days emerge in Hacking Team leak

#120

Post by x0x0 »

al2o3cr wrote: post #78
dguido wrote: post #66

Earlier quoted context omitted.

You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part). If you're running an update to date flash, that means you're probably running it in a sandbox and probably have silent auto updates turned on. That's good enough for most people. If you're the kind of person that's going to get specifically targeted, then you should…

"You think that any other software you use is any better?" I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr... To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.

data: I grabbed all 500+ records and counted, by month, those with severity 10 (column 10) and severity >= 7 (column 7). Rows is the # of cve records for that month.

it's not awesome

   month   rows 10  7
   2015-07   35 28 29
   2015-06   14  7  7
   2015-05   17 10 10
   2015-04   22 19 19
   2015-03   11  7  9
   2015-02   19 19 19
   2015-01   12  9 11
   2014-12    6  5  5
   2014-11   19 16 18
   2014-10    3  3  3
   2014-09   12 11 12
   2014-08    8  7  7
   2014-07    3  0  2
   2014-06    6  1  3
   2014-05    5  0  5
   2014-04    4  1  2
   2014-03    4  2  2
   2014-02    4  3  4
   2014-01    2  2  2
   [...]
2015 has not been kind to them, but it's been a continuous trickle of remote severity 10s every month for a year and a half

truncated because it took too much space; full results: https://gist.github.com/anonymous/763e28612b74d3a1817a

NB: only months with at least one cve event show up, but given adobe's focus on security, it wasn't really necessary to fill in months with 0 events to get the point across

download each screen full of results from the cve site into a single directory and run this script: https://gist.github.com/anonymous/990bfe126d273ef84134

Post reply on HN