Adobe Systems have released an emergency update to fix a dangerous security hole in its widely-installed Flash Player browser plugin. The company warned that the vulnerability is already being exploited in targeted attacks, and urged users to update the program as quickly as possible.
Following this news, Mark James, Security Specialist at IT Security firm ESET and Amichai Shulman, CTO of Imperva explains why Adobe Flash is targeted so often and what users should do to protect themselves.
Mark James, Security Specialist at IT Security, ESET:
“Since Flash is such a widely used plugin, it stands to reason that it will be one of the most targeted apps for vulnerability. If you want to affect as many people as possible then you need an application that a lot of users use and flash is one of them. This is an excellent example of why you should be very aware of updates for software not only operating systems. Checking to see if any updates are available and installing them immediately is the only way to help protect yourself in the minefield of the software world that we use today.
There is an excellent link that everyone should save and use as often as they can to check to see the latest version of flash and more importantly see if their version is the same or needs updating.
I have shown the full link above and I request that you please be very careful of following links to update sites as these could sometimes be used to direct you to other malicious sites. I would personally recommend that you manually type the link to be absolutely sure if you have any concerns at all.”
Amichai Shulman, CTO, Imperva:
“This is a reminder that the average end user machine is extremely vulnerable to infection at any given point in time, even for individuals and organizations who carefully observe patching practices. It emphasizes what we believe is should be the moto for modern corporate information practices: you have been compromised, make sure it does not turn into a breach. What it means is that organizations must shift their security investments to solutions that protect their data from abuse rather than their end stations from being compromised.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.