ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Zero Day readers, why aren't you patching Flash Player?

By | November 3, 2010, 9:03am PDT

Summary: According to our statistics counter, the majority of you (security-savvy readers?) are very tardy in applying Flash Player updates.

Adobe’s plan to rush out a fix for the latest Flash Player zero-day vulnerability got me thinking about patch adoption rates among ZDNet Zero Day readers.

According to our statistics counter, the majority of you (security-savvy readers?) are very tardy in applying Flash Player updates.

Here are the numbers for Flash Player installations from all visitors to this blog in October 2010.  Only 65% of you are running a fully updated version of Flash Player (10.1.85.3).

Every version of Flash Player marked as “Outdated” is vulnerable to remote code execution vulnerabilities that can be exploited via the Web to launch drive-by malware downloads (no extra click required).

Like I said, the readers of this blog are mostly security/computer savvy and on top of security issues.  If these readers are so tardy in applying patches for such a commonly targeted application, it’s safe to assume the average mom-and-pop users are even further behind.

There really is no excuse to be running an outdated version of Flash.  You can use this link to check your Flash version.   If you’re running Mozilla Firefox (33% of you), use the Plugin Check utility.

Here’s a look at Zero Day readers that support Java, another huge target for malware attacks:

Frightening.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Adobe Systems Inc., Ryan Naraine, Day Reader

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
43
Comments
Add Your Opinion

Join the conversation!

Just In

32 bit lingering...
pgit 5th Nov 2010
@patrickwbarnes Thanks for the nudge. I looked into it and from a troubleshooting episode some time back I had a local plugins folder under /home that was overriding the system plugins under /usr/lib64. It was an older version, way old.

Glad I mentioned it, and you prodded, thanks.
View in thread
0 Votes
+ -
Patches come daily automatically with Ubuntu
Dietrich T. Schmitz, ~ Your Linux Advocate 3rd Nov 2010
The zero day blog provides a good service.

Still, I can't emphasize enough how important having an extra layer of security is.

Ubuntu Linux comes with AppArmor and various profiles, including ones for Adobe and Firefox. If used, your App's session will be placed in a 'sandbox' so that even though there may be a zero-day that targets your platform, AppArmor stands in its way and stops all privilege escalation attempts.

Your Ubuntu Canonical repository will automatically dispatch to your system any and all updates just as soon as they become available. In the meantime, your system is safe with AppArmor.

Ubuntu Linux: The safest operating system on the planet.

I stake my reputation on it.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
[deXter] 3rd Nov 2010
@Dietrich T. Schmitz, Your Linux Advocate

Actually, most *nix distros are pretty safe to use but Ubuntu doesn't fare so well in my list, I mean compared to OpenBSD, QNX, Arch or even openSUSE...
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
shellcodes_coder 3rd Nov 2010
@Dietrich T. Schmitz, Your Linux Advocate
same old boring dialog again?
0 Votes
+ -
I recommend and use Secunia PSI
NonZealot 3rd Nov 2010
http://secunia.com/vulnerability_scanning/personal/

It will tell you if Java or Flash (and thousands of other programs) are out of date.
0 Votes
+ -
May I recommend Flame Guard Gel?
Dietrich T. Schmitz, ~ Your Linux Advocate 3rd Nov 2010
@NonZealot

fyi,
http://www.energetech.com/flameguard.htm
Apply liberally to the scalp.
"Be safe in the knowledge your hair won't catch on fire. Be safe with Flame Guard"
0 Votes
+ -
I LIKE CAKE
NonZealot 3rd Nov 2010
@Dietrich T. Schmitz, Your Linux Advocate
http://www.hanselman.com/blog/ILikeCakeCakemailNinjasOnFireAndOtherAnecdotes.aspx
any time anyone in any meeting said something that was far enough off topic or sufficiently non-sequiturial, someone would declare "I LIKE CAKE!"
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Chiatzu 3rd Nov 2010
@Dietrich T. Schmitz, Your Linux Advocate
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
twaynesdomain 3rd Nov 2010
@NonZealot
Windows since XP can do that too, but I've found it rather useless as most of the "updates" are unnecessary and so mundane they aren't worth fiddling with. Not to mention the occasional error or gotcha that conflicts with some programs. Windows does it wrong IMO. Always use the vendor for updates; lists are not trustworthy.
0 Votes
+ -
Actually . . .
JLHenry 3rd Nov 2010
@twaynesdomain

What Secunia does is directs you to the vendor's website to install the update from there. It also looks around for old versions that need to be uninstalled. Because of this, I noticed that Whenever you get a Chrome update(as an example), it simply installs the program, but doesn't remove the old version's folder. You have to go in and manually remove the older version.
0 Votes
+ -
Because then they wouldn't be able to honestly claim they didn't get...
ye Updated - 3rd Nov 2010
...infected. They have to continue using older versions of software so they can claim Windows is insecure and provide examples. All the while leaving out critical information such as they are not patching.

Seriously though...Adobe's update mechanism leaves a lot to be desired.
0 Votes
+ -
Because of other Adobe Software
MichP 3rd Nov 2010
My husband uses Adobe Connect for work. At least in the past, whenever Java or Flash was updated (I forget which), Connect would quit working, saying it didn't support the new version. He couldn't update Connect, so he'd have to go downgrade, block all automatic updates, and wait until Connect was updated by IT. That could take a couple months. So now he's understandably unwilling to allow any updates like until he knows he has enough time to undo them if they break Connect.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
davidmpaul 3rd Nov 2010
WHO told me I needed to update? IT did not. Adobe did not. Wonder why machines get infected? There is no clear way to understand when we need to update! At least Microsoft has auto update.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
[deXter] 3rd Nov 2010
@davidmpaul I agree. They should have a non-intrusive hot-patching update facility. Flash is too vulnerable to leave unpatched for long durations.. even if they implement an update mechanism that's similar to Chrome, it would be much better than the present implementation.
0 Votes
+ -
Linux 64 bit
pgit 3rd Nov 2010
I have the latest release for 64 bit Linux on board, and the test says I'm vulnerable.

So it's not my fault, adobe hasn't updated the player yet.

BTW I assume you use google analytics to glean the data you provide? If that's the case I'm not included in your stats, g-a is normally the first thing I disallow any scripts from and blacklist upon a clean install of firefox.

I also have a user agent switcher and often use different agent reporting, eg IE7 on vista... whereas I really have firefox on Linux 2.6.34.6
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
patrickwbarnes 3rd Nov 2010
@pgit You may want to check that you really have the latest plugin. I just ran the check with the latest 64-bit plugin under Firefox 4b6 on Fedora 14 and it passed. The latest 64-bit Linux Flash plugin is "Square" preview 2.

I suspect the biggest burden keeping people on older Flash versions is Adobe's failure to provide quick, no-interaction-required automatic updates for them. If it requires user action, you can be sure a good percentage of people will fail to do it, even among the tech-savvy.
0 Votes
+ -
32 bit lingering...
pgit 5th Nov 2010
@patrickwbarnes Thanks for the nudge. I looked into it and from a troubleshooting episode some time back I had a local plugins folder under /home that was overriding the system plugins under /usr/lib64. It was an older version, way old.

Glad I mentioned it, and you prodded, thanks.
0 Votes
+ -
because
g_keramidas@... 3rd Nov 2010
i never installed the piece of crap in the first place
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
twooters 3rd Nov 2010
Because Adobe won't let you update without installing other unwanted software.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
kaybradley 3rd Nov 2010
I run a program on my browser (Safari) which blocks flash unless I click a symbol (on the page where a flash item is). It saves me HUGE amounts of grief, & it's actually rare I need flash - and then I only click from a trusted source. So I don't update that often (I was only 1 patch back when I checked the links provided).
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
twaynesdomain 3rd Nov 2010
@kaybradley Is that a Safari feature, an add-in, or a 3rd party program?
0 Votes
+ -
Don't force us to use that stupid Adobe DLM download manager!
rsmith187 3rd Nov 2010
Adobe has buried the link to download the standalone version. Extremely irritating to have to install a useless DLM plug in and uncheck the box to NOT include McAfee crap along with my download.... and knowing Adobe, someday they'll find an exploit in the DLM plug in... no thanks.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
bionicbub 3rd Nov 2010
It took me six attempts to patch the Flash Player. It would not "stick."
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Laura Silvero 3rd Nov 2010
not for nuthin', but Firefox (3.6.12) doesn't want to do it and it's a bear trying to find a way to do a manual install...........
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
twaynesdomain 3rd Nov 2010
I suspect it's something we'll need to learn to live with; either the Flash or the use of it on certain sites. I've been trying without success to write a script to shut of off/turn it on but so far no luck; gotta suffer the keystrokes.
0 Votes
+ -
delays, download managers, deinstalls, reinstalls
Narr vi Updated - 3rd Nov 2010
I actually patch religiously on these alerts - and remove Flash during zero-day intervals, which neither you nor Adobe are sensible enough to suggest.

Often when it hasn't been necessary to risk-remove, the Adobe update cycle is simply nonsense.

- announcements come, but no update software is available, often for an additional day.

- funky special downloaders are 'required' by normal channels, and the update software itself is hidden.

- you have to install differently to update different browsers. Why doesn't one update carry both types of Flash, to make this foolishness and normal-person-blocking go away?

- often, the Adobe updater fails, at least on very up to date Windows 7 32-bit. Then you have to track down the well-hidden actual Adobe updaters, _and_ the Adobe uninstaller to run first. Then run the installers, and check that your browsers are actually running Flash in its new incarnation.

That Flash is attacked is not a fault. It is in the same high-install-percentage/new-requirements-on-what-was-legacy software bind as any good tool.

That Adobe don't put an auto-updater with user OK option, so that Flash is painlessly brought to latest version as soon as a user wants it to be after an important release, is foolish.

What we have is tech-driven ' what we have to do' , instead. No, it doesn't have to be this way.

Oh yes. One more complaint. Chrome has now its own copy of Flash -- a third vulnerability point. Yes, I understand this was meant to help. But how many people know how to disable it when trouble comes - and without a coherent rapid-update-dispersal system from Adobe, the Chrome update actually happened a day or more later than any other update the last time we had a zero-day. I know, because I manually updated to get around this.

Adobe needs to grow up, and treat security as a first-class, everyday matter, not to be left to technocratic vision alone.
0 Votes
+ -
Isn't 65% a majority?
danindenver 3rd Nov 2010
~According to our statistics counter, the majority of you (security-savvy readers?) are very tardy in applying Flash Player updates.~
I just don't understand! I know that I went to public school, but, if "65% of you are running a fully updated version of Flash Player", isn't that a majority?

*** Lucid Lynx means Liberation! *** Windows is now obsolete ***
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Boomslang 3rd Nov 2010
@danindenver

ZDNet New Math. You have entered a parallel universe where black is white, more is less and up is down.

Unless they're making the comment on the fact that in reality anyone currently running Flash is unpatched as of this current time. I pretty much figure that you have about three safe days after a Flash patch before you're being exposed to the next Zero Day.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
14wntr 3rd Nov 2010
I am so sick of updating..... Die ADOBE!!
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
shellcodes_coder 3rd Nov 2010
Running Windows 7, no flash, no java happy
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Boomslang 3rd Nov 2010
The best patch yet for Flash I've found is universally available and always up to date. It's known as the Flash Uninstaller and can be found from this page: http://kb2.adobe.com/cps/141/tn_14157.html
This and a few registry entries to prevent reinstall eliminates quite a bit of hassle and those stupid moving ads and permanently removes this current insecurity freeway into your computer.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Chiatzu 3rd Nov 2010
I try not to be tardy and always patch when the patch is available. I'm a stickler when it comes to updates, software, firmware, etc. It's just that these Adobe-ized exploits are happening so frequently and patching on an irregular schedule (weeks or months before a fix is released ("we'll get to it when we get to it") that it's sometimes difficult to always wake up thinking about patching Flash or Reader, or some other Adobe product. We're trying.
0 Votes
+ -
Something I learned recently
kandyass@... 4th Nov 2010
When you install the latest flashplayer on windows, it doesn't patch the old vulnerable one, you actually have to go and remove the old one yourself. I figured this out using the Secunia PSI tool on windows 7.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Oikid 4th Nov 2010
Well, how many of your readers are using a version of Windows? I'm using openSUSE 11.2 and the latest versions of Flash show up on Yast not much after they are released by Adobe.

I have removed Java a while ago. It's not worth the risk.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
kenneth.kelley@... 4th Nov 2010
How do you account for the numbers of users running IT controlled systems that the user couldn't update even if they wanted to?
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
drf999 4th Nov 2010
Well for a start, Flash, Java and scripts are all blocked. If it can't be done in HTML, I basically can't be bothered.
0 Votes
+ -
Third-party app
Greenknight_z 4th Nov 2010
There's a very small program available that provides the Flash update functionality that Adobe should have: http://www.wecode.biz/p/alternative-flash-player-auto-updater.html

It's been tested by Major Geeks - spyware and adware free. Works very nicely.
0 Votes
+ -
Patching 3rd Party Applications - The Challenge Continues...
deZDNet Updated - 4th Nov 2010
I thought your article was very interesting! The challenge surrounding the ability to assess for and deploy missing security patches for 3rd party applications like of Adobe, Real Player...etc., continues be a daunting task! That said, there is a tool available that may be useful to those that continue to wrestle with this issue. Shavlik Technologies provides a free tool called IT.Shavlik.com ( https://it.shavlik.com/) that allows you to scan for and deploy missing security patches for Adobe, and many other 3rd party applications. I would strongly recommend to anyone who is struggling to patch 3rd party applications to test out Shavlik.

de
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
zclayton2 4th Nov 2010
because we don't have admin rights to our machines and IT here doesn't rush to judgment - or much else.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
syleishere@... 4th Nov 2010
The main reason is ADOBE's stupidity once again. While performing upgrade on my desktop I hit OK quickly just to get it over with which I am sure everyone did, but when doing it on my laptop I realized I had to agree to terms of service for it to actually install I noticed, so people most likely did patch, but didn't realize they didn't because of agreeing to terms of service checkbox not being clicked.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
tiredofpickingusernames 4th Nov 2010
Adobe is unwilling to check their own code, yet you expect us to blindly field all these new Flash updates as soon as they're released?

How does that make sense?

IMO, it's safer to make sure all your users have flash blockers installed. Then take the time actually test the releases before fielding them.
0 Votes
+ -
The reason I'm tardy is because of...
D. W. Bierbaum 4th Nov 2010
The stupid way Adobe updates are handled, requiring the installation of a separate (and ANNOYING) download manager, or the use of their online installer of things you don't want to install, while they HIDE their direct downloads so that it's next to impossible to get at.

At least Shockwave does an okay job of updating itself by itself. Sometimes. Flash is not good at this at all.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
martin888 4th Nov 2010
Very timley question. Why not? It is not a clear and seamless patch. It is cumbersome it is a break in your daily task. Is it restricting some other access that we may already have. And Why does Adobe's request come so frequently? They need to be less intrusive and very seamless, and secure. Just work it out at home base first
and then serve it out. Not more than once in 90 days.
0 Votes
+ -
RE: Zero Day readers, why aren't you patching Flash Player?
Telix 5th Nov 2010
The simplest thing to do is either uninstall it or disable it flash is a pain in the ass.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix