|
According to Scott Dunn of Windows Secrets, Flash-based advertisements on the USA Today site download malicious code to users' computers, generating false warnings of a malware infestation and offering a fake solution.
The Flash vulnerability is so widespread that such "malvertisements" may be present on thousands of sites, but there are measures you can take to reduce your exposure.
Just opening the page puts you at risk
Visitors to USAToday.com got more than they bargained for. A hacked Flash advertisement meant that merely viewing a page in your browser was capable of triggering a malware attack on your PC. Apparently, the ad can take control of the browser without any user interaction at all.
Two days after the ad appeared on the USA Today site, two prominent Utah-based news sites, DeseretNews.com and SLTrib.com, were found to have similarly dire banner ads. These ads directed users to various unexpected locations, including the site for AntiSpywareMaster. This destination has been called a "corrupt anti-spyware parasite" and a "fake program" by the RDV Group, a safe-computing organization.
News sites aren't the only victims. Even Microsoft-sponsored sites have had problems serving up malvertisements though they denied it at first. And advertisements are not the only source of the problem. The principal conveyors of this malicious code are Flash animations (or .swf files), which are commonly used to create intro screens, online video, and other Internet content in addition to Web ads.
Of particular concern are Flash files that are vulnerable to insertion of malicious code using a technique called cross-site scripting, or XSS.
This vulnerability was widely publicized earlier this year by Google researcher Rich Cannings and his co-authors in their book Hacking Exposed Web 2.0: Web 2.0 Security Secrets and Solutions.
What you can do to protect yourself
Even though the long-term solution is for the providers of Flash-based content to create more secure versions of their files, there are some measures users can take to protect themselves. These protections are not foolproof, but they at least reduce the risk of exposure to malware via compromised Flash files.
Some of these tips come from Andre Gironda, Secure SDLC Consultant and author of the ts/sci security blog.
The no-Flash option
The most effective - albeit drastic - way to protect yourself from malware-bearing Flash files is to uninstall Flash entirely. Adobe provides a special tool for doing this; you can find instructions and a link for downloading this file in a Technote published on the Adobe site.
The part-time-Flash option
If going without Flash entirely is too extreme, you can limit the sites that use this and other risky plug-ins by installing free browser add-ons that let you manage active Web content more granularly:
For Internet Explorer, TurnFlash lets you toggle between blocking Flash files and allowing them to run. A tray icon lets you turn Flash on or off, but the setting takes effect only in any new IE windows that you launch, not in the existing browser window.
A similar utility called No! Flash also switches Flash on and off, but it also gives you the ability to turn off several other elements, such as Java applets and other scripts. As with TurnFlash, the changes take effect in the next IE window you open
Installing IE7Pro add-on requires you to restart Internet Explorer 7 when it's first installed, but you can turn Flash animations on and off thereafter without launching a new instance of the browser. Moreover, the program lets you selectively unblock individual Flash animations on a single Web page.
This free add-on for IE7 adds a number of other useful features to the browser, including tab management, spell checking, and crash recovery.
For Mozilla Firefox, a plug-in called Flashblock disables all Flash content on Web sites and replaces it with a round Flash logo. You can selectively enable Flash files by clicking their icons.
For more comprehensive security, the plug-in NoScript not only disables Flash but also turns off Java, Silverlight, and other active Web elements. A NoScript icon in the Firefox status bar provides a pop-up menu for adding a site you trust to the add-on's "whitelist," which enables all scripts and animations on the site (but not necessarily those on the site's pages that are served up by ad networks). You can also right-click a link in Firefox to set its NoScript options via the context menu.
The minimal option
At the very least, update the Flash Player software on your system to the latest version (9.0.124.0 or higher). In the last three months, Adobe has patched a number of security holes in this product. The update won't protect you from all buggy Flash files on the Web, but it will make your browsing much safer.
You can download the latest Adobe Flash Player from the Adobe Website.
After you install the update, run the free Secunia Software Inspector online malware scanner to find old versions of the Flash Player that may have been left behind on your system. Secunia's on-screen report will show the path and filename of the old files you need to delete. You may have to run the inspector more than once to make sure all the old files are deleted. If you delete a needed file by mistake, simply run the newest Flash Player installer again to correct the problem.
When it comes to removing an old version of the Flash Player, Rick Austin has some advice:
- "As a fan of Secunia's Software Inspector, I frequently have been notified to install the latest up-to-date version of the Flash Player and get rid of the old one. But I have found that getting rid of the old version as you describe doesn't work. The only way I know to do it is as follows:
Step 1. Download the Adobe Uninstaller found on Adobe's Web Players page and save it for future use. (It only needs to be downloaded one time, because it is not version-sensitive.)
Step 2. Create a desktop shortcut linking back to the same Web Player page.
Step 3. Close the browser.
Step 4. Run the "Uninstaller."
Step 5. Click the link to the Web Players page to open your browser, and then run the appropriate installer.
Step 6. Run Secunia to confirm.
Step 7. Rejoice!
"This works every time for me."
Thanks, Rick. Some users may also need to uninstall other applications that come with Flash components __ such as older versions of Adobe Photoshop Elements __ and then upgrade to newer versions.
One danger posed by Flash bugs is the ability of hackers to get your login credentials for a given site. Andre Gironda recommends creating multiple Firefox profiles, each with its own NoScript (or, if you prefer, Flashblock) settings. He uses his Flash-enabled profile to browse sites such as YouTube, but he exits that browser and launches his Flash- and script-blocked copy of Firefox when he conducts online banking and visits other sites that require logins.
To set up a Firefox profile, do the following:
Step 1. Choose Start, Run. Type cmd.exe and press Enter.
Step 2. At the command prompt, type:
"C:\Program Files\Mozilla Firefox\firefox.exe" -profilemanager
Then press Enter. (Note that the quotation marks are required and that your path may differ.)
Step 3. If you want Firefox to prompt you for a profile each time you launch it, uncheck the option Don't ask at startup in the Firefox __ Choose User Profile dialog box.
Step 4. Click Create Profile and follow the steps in the wizard to name your new profile. Repeat the steps to create a second profile. For example, you might name one profile Flash-Yes and another Flash-No. When you're done, click Exit.
Step 5. Rather than being prompted for a profile each time you open Firefox, create separate shortcuts to launch each profile. For example, if you have a shortcut to Firefox in your QuickLaunch toolbar or on the desktop, drag the shortcut with the right mouse button pressed, drop it, and choose Create Shortcuts Here.
Step 6. Right-click one of your Firefox shortcuts and choose Properties. Click the Shortcut tab and edit the command line so it ends in with -p followed by a space and the name of one profile. For example, the entire command line might read:
"C:\Program Files\Mozilla Firefox\firefox.exe" -p Flash-Yes.
Repeat these steps for a second shortcut to launch your other Firefox profile.
Step 7. You may need to download and install one of the plug-ins described above for these profiles and configure each profile's browser differently. However, any changes you make should be saved with that profile, so they will be in effect the next time you launch it.
If you don't want to create separate profiles for Firefox you can install two browsers - for example Firefox with Flashblock, and IE for when you need Flash to view some content.
A complete solution to high-risk Flash files may not come any time soon. Until the creators and managers of these files can ensure a high degree of safety, users have to be extra cautious to avoid the risks of Flash-borne malware.
|
formatted; the format command is only testing the hard disk magnetic surface in order to see if there is any error and, in case an error is found, marks the defective area as bad (the famous "bad blocks" or "bad sectors"). 
