The IT Nerd

If you’re using older versions of Adobe Creative Cloud apps, now might be a great time to upgrade. Because according to Adobe, you might get sued if you don’t. Customers have been getting emails from Adobe in regards to this which apparently aren’t too nice. And one customer reached out to Adobe on Twitter and got this response.

The apps affected include Photoshop, Lightroom Classic, Premiere, Animate and Media Director. And you’re likely wondering why using older versions of these apps is an issue. Well, it stems from the fact that a lot of creative types have workflows that work best with older versions of software. Or they are just used to the software and don’t want to change. Or they don’t want to introduce issues by upgrading to something that breaks their workflow.

Apparently this stems from a licensing dispute between Adobe and Dolby which seems to be turning ugly. Thus users of Created Cloud should consider themselves warned because by the time a company starts sending out notices like these, it’s a sign that things are not good.

Last week I told you about an Adobe Flash exploit that had been around since November and was actively being used by North Korean hackers. Adobe promised to fixed it this week and they did. But in the process of fixing that exploit, they disclosed that there was a second exploit that was floating around unfixed. It’s documented in the CVE database as CVE-2018-4877 and in short, it’s an exploit that allows for remote code execution. In other words, doing something as simple as opening a webpage or other document with a malicious Flash file embedded in it will pretty much result in pwnage if you have the wrong version of Flash installed. Thus, you should update your version of Flash right now to avoid pwnage.

Or the better route is to dump Flash completely because it’s a security nightmare that Adobe cannot remedy. Thus since Adobe can’t save you from the nasties that are out there, you have to save yourself.

I’ve been saying for a very long time that if you want your computer to be secure, you need to dump Adobe Flash. On top of the security factor, you have no practical need for it as the world has moved on to standards like HTML5. But here’s a new reason not to run Adobe Flash. South Korean authorities have found a dangerous new Zero Day exploit that leverages Adobe Flash:

According to a security alert issued by the South Korean Computer Emergency Response Team (KR-CERT), the zero-day affects Flash Player installs 28.0.0.137 and earlier. Flash 28.0.0.137 is the current Flash version number.

“An attacker can persuade users to open Microsoft Office documents, web pages, spam e-mails, etc. that contain Flash files that distribute the malicious [Flash] code,” KR-CERT said. The malicious code is believed to be a Flash SWF file embedded in MS Word documents.

What makes it worse is that the North Koreans are apparently behind this and it’s been around since November and it’s actively being exploited. This has Adobe scrambling to fix this and a fix is coming out on Monday. Which is pretty craptastic on Adobe’s part seeing as this has been around since November and is actively being exploited. So if you still run Adobe Flash for whatever reason, make sure that you update it on Monday. Or better yet, uninstall it and make yourself more secure than you are now.

In a strange twist of fate, there’s now a petition to open-source Flash. Here’s where it gets weird. The petition acknowledges Adobe’s reasons for killing Flash, namely that it’s been superseded and is woefully insecure. But….:

However Flash along with its sister project Shockwave is an important piece of Internet history and killing Flash and Shockwave means future generations can’t access the past. Games, experiments and websites would be forgotten.

Open sourcing Flash and the Shockwave spec would be a good solution to keep Flash and Shockwave projects alive safely for archive reasons. Don’t know how, but that’s the beauty of open source: you never know what will come up after you go open source! There might be a way to convert swf/fla/drc/dir to HTML5/canvas/webgl/webassembly, or some might write a standalone player for it. Another possibility would be to have a separate browser. We’re not saying Flash and Shockwave player should be preserved as is.

I don’t know of anything that was made with Flash that would be worth this effort to preserve a piece of software that is horribly insecure. But that’s just me. If you have a different view of this, I would ask you to share your thoughts by leaving a comment.

Somewhere Steve Jobs is declaring victory when it comes to killing Adobe Flash. The news is out that the once popular, but now exploit ridden browser plug in will be dead by 2020:

The software company’s decision to phase out Flash is noteworthy considering that the software has been synonymous with Adobe since its debut for playing videos and animations in web browsers. As the Internet matured and grew in popularity over the years, so did Flash, which became one of the most widely used ways for people to watch video clips and play online video games.

But as more people used Flash, criminals increasingly found ways to exploit security vulnerabilities in the technology and hack into people’s computers. Flash’s increasing holes and bugs soon became a source of frustration for some of the world’s biggest technology companies.

Frankly, Flash won’t be missed. With standards such as HTML 5 and Web GL, there are way better and safer ways to display web content than Flash.

R.I.P. Flash.

UPDATE: Here’s the official word from Adobe.

If you are still running Adobe Flash for whatever reason, you need to upgrade it now. As in right now. The version that you need to be running 24.0.0.221 as it “address critical vulnerabilities that could potentially allow an attacker to take control of the affected system”. These holes are on Mac, Windows and Linux.

So, if I were you I would run to the Adobe Flash Player Download Center and update away. Or better yet, dump Flash and make your system a whole lot more secure.