Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Adobe Hopes Pop-up Warnings Will Stop Office-Borne Flash Attacks

timothy posted about a year and a half ago | from the ms-bob-is-on-the-case dept.

Microsoft 125

tsamsoniw writes "In the wake of the most recent zero-day attacks exploiting Flash Player, Adobe claims that it's worked hard to make Player secure — and that most SWF exploits stem from users opening infected Office docs attached to emails. The company has a solution, though: A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat."

cancel ×

125 comments

Sorry! There are no comments related to the filter you selected.

Separate the code and the data (5, Insightful)

Gothmolly (148874) | about a year and a half ago | (#42840799)

This is why your data should not be executable.

Re:Separate the code and the data (5, Insightful)

Darinbob (1142669) | about a year and a half ago | (#42840857)

People want convenience. And convenience is the mortal enemy of security.

Re:Separate the code and the data (5, Interesting)

davester666 (731373) | about a year and a half ago | (#42841027)

WTF is so convenient about having Word being able to display Flash content?

Do a significant/noticeable number of people embed Flash content in their Word documents?

How about Flash just preventing itself from running in non-browsers [and maybe their standalone Flash app]?

Re:Separate the code and the data (3, Insightful)

rudy_wayne (414635) | about a year and a half ago | (#42841249)

WTF is so convenient about having Word being able to display Flash content?

Do a significant/noticeable number of people embed Flash content in their Word documents?

The number of people actually doing this for legitimate reasons is probably very small. The problem is, companies like Microsoft and Adobe must constantly release new versions of their software in order to keep a constant revenue stream. And that means constantly adding new "features" of questionable value.

Re:Separate the code and the data (4, Informative)

thegarbz (1787294) | about a year and a half ago | (#42841455)

While that may be true for flash specifically, the number of people who embed complex programming scripts into word documents is incredibly large. I've never worked for a company which didn't have some bizarre use for it.

A small Pizza joint used a complicated array of javascript to automate their ledgers which were kept in an excel file rather than an accounting program.
A biscuit factory I worked for actually managed to turn a very large collection of excel files into a rudimentary database with an insanely complicated set of scripts embedded in each file. This surprisingly worked, though you pushed a button and it would open many files in excel at once and the computer ground to a halt while computing the necessary ingredients for the next batch.
Now I work for a large fortune 500 company and every word document is embedded with complicated scripting to automagically update footers and synchronise with a 3rd party document management system.

While I haven't seen flash specifically it is not at fault here security wise, embedding programming languages into content files is, and that is incredibly common.

Re:Separate the code and the data (1)

ewanm89 (1052822) | about a year and a half ago | (#42842281)

Excel technically is an accounting program, spreadsheets were first created to do double entry book keeping.

It's better than most the other uses I've seen for it, like excel based databases.

Re:Separate the code and the data (4, Insightful)

Titus Groan (2834723) | about a year and a half ago | (#42842459)

just because the software is flexible enough to do the job doesn't make it the right tool for that job. this system can indeed be built in house by those who don't have a full understanding of programming but do have a better insight in to the data that's being manipulated. it's going to be poorly documented and when it breaks or goes wrong very few people are going to be able to fix it for you. Do the job properly from the outset - hire a programmer and have custom software written to your spec. The false economy of using off the shelf products has led to many companies downfall.

Re: Separate the code and the data (0)

Anonymous Coward | about a year and a half ago | (#42842599)

Really? Do you have any examples of companies who fell down because of poor use of spreadsheets? I agree with the main point, but haven't seen it tank a company yet.

Re:Separate the code and the data (4, Interesting)

DNS-and-BIND (461968) | about a year and a half ago | (#42842015)

I've noticed this in reverse: app reviewers on Google Play complain if the app hasn't been updated in a while - even if it is complete and stable. To the modern user, updating frequently doesn't mean "broken-ass program with lazy programmers", it means "normal".

Re:Separate the code and the data (1)

Titus Groan (2834723) | about a year and a half ago | (#42842427)

this is why they're moving to software as a service. they've realised that the feature bloat is not sustainable.

Re:Separate the code and the data (1, Insightful)

symbolset (646467) | about a year and a half ago | (#42841585)

Why fix on flash? Word can be Pwned by an image, an embedded spreadsheet, a document template, one of a hundred forgotten media formats - or even a font. It's a beautiful gateway to being pwned that requires no user interaction. You don't even have to open a document: it installs pwnable services to facilitate remote management by random strangers.

Re:Separate the code and the data (2)

cellocgw (617879) | about a year and a half ago | (#42842613)

Word can be Pwned by an image, an embedded spreadsheet, a document template...

Exactly. Add to that the fact that any jackass who's learned to click on "Developer" can create a macro. I recall one horrible Word macro provided to our company from a customer (this is in the DoD world, where all sorts of 'mandatory forms' are passed around). The concept was stupid enough: when this document template was opened, an autorun macro created an extra Menu item (back in the heavenly days before the cursed Ribbon) full of special macro-backed commands we had to use to fill the Word doc with hours/dollars estimates. Yep- they stuck math macros in there to do spreadsheet summations. Then when the user was done, quitting Word ran *Another* autorun macro to clean out the extra menu crapola.
Anyone see the craptastic FAIL yet? :-) . If you close this particular document but have other Word docs open, the autorun_on_close macro doesnt' execute. But since the document containing said macro is closed, when you quit Word the extra Menu remains!
Extreme hilarity results. (not really)

Re:Separate the code and the data (0)

Anonymous Coward | about a year and a half ago | (#42842513)

And a related question: if I have Flash installed, does this mean that this "Flash in an MS Office document" vector is automatically installed by default? I hadn't even heard of this dubious feature. As you say, why????

Is there a way to completely disable this almost useless feature within MS Office?

Re:Separate the code and the data (0)

Anonymous Coward | about a year and a half ago | (#42841133)

And now a public service message from the Rolling Stones [rollingstones.com] .

Re:Separate the code and the data (1)

Nyder (754090) | about a year and a half ago | (#42841971)

People want convenience. And convenience is the mortal enemy of security.

I thought being cheaper was the mortal enemy of convenience.

For example, "convenience" stores are only convenient because they are closer, not because they sell stuff at twice the price of grocery stores.

But then I can see your point, because the convenience store doesn't hire a security guard, while the grocery store usually has 1 or 2.

So yes, I guess your correct.

Re:Separate the code and the data (4, Funny)

nmb3000 (741169) | about a year and a half ago | (#42841279)

This is why your data should not be executable.

I'm trying to figure out what possible reason to have Flash embeddable inside an Office document someone might have. Maybe you could argue that it's worth being able to embed in a PowerPoint slide, but even that is reaching.

A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat.

I think a better solution is to disable Flash entirely* when run from an Office document and instead display a message that says:

"Flash has been disabled. To enable Flash content, contact your system administrator and he will come back there and hit you on the head with a tack hammer 'cause you are a retard [youtube.com] ."

* of course with the obligatory registry-key-bypass for corporate users

Re:Separate the code and the data (3, Funny)

symbolset (646467) | about a year and a half ago | (#42841963)

What does it matter? Office may as well be considered a remote access terminal server backend with system privileges for a metasploit frontend remote desktop client. The document preparation features are optional and in most cases redundant.

Re:Separate the code and the data (2)

hedwards (940851) | about a year and a half ago | (#42841293)

And, this is why Adobe should have removed the ability of Flash to expand randomly to trick the user into clicking on something they clearly didn't want to click on in the first place.

Well, not Adobe, that's why Macromedia should have done it and why webmasters shouldn't be doing it.

Oh god, this is marked insightful (2, Informative)

symbolset (646467) | about a year and a half ago | (#42841561)

I hate to tell you this but code is data. Specifically it is the data about what you want the machine to do. There are methods to separate operators from operands, but none of them deliver the utility we demand.

Re:Separate the code and the data (0)

Anonymous Coward | about a year and a half ago | (#42841575)

You can thank John von Neumann for this. Ever since his work on the EDVAC and ENIAC, it has been possible to execute data.

Re:Separate the code and the data (1)

symbolset (646467) | about a year and a half ago | (#42841865)

Code is data.

Re:Separate the code and the data (0)

Anonymous Coward | about a year and a half ago | (#42842211)

This is unfortunately where remote code execution exploits come into play, it doesn't matter if your data is executable, it matters whenever the code interpretting your data is a buggy piece of crap.

Re:Separate the code and the data (0)

Anonymous Coward | about a year and a half ago | (#42842351)

You have something against Lisp??? :(

Clever move (4, Insightful)

physlord (1790264) | about a year and a half ago | (#42840811)

Yeah!. Since the average user totally understands the situation, that "vague warnings of a potential threat" will, obviously, solve the problem. Pure genius.

Re:Clever move (1, Informative)

PNutts (199112) | about a year and a half ago | (#42840849)

The "vague" warning on Office 2008 or earlier is below. The default is do not allow content to play. It's inline with other generic warnings so let's try to keep the FUD to a minimum.

Also, Office 2010 has a Protected Mode sandbox. If it's from the Internet or Untrusted Zone the Protected View feature prevents it from running by default.

"This document contains embedded content that may be harmful to your computer.
Choose from one of the following options:
- Do not allow content to play (Recommended).
- I recognize this content. Allow it to play."

Re:Clever move (2)

the_Bionic_lemming (446569) | about a year and a half ago | (#42841281)

Which gets blindly clicked thru since they see that pop up dozens of times a day.

I am a fan of microsoft up until after win xp, but UAC and the effing annoyance it causes with legit apps was definitely not the way to go to improve security.

Re:Clever move (0)

Anonymous Coward | about a year and a half ago | (#42841809)

upto win XP?

Those warnings are in office 2000 if not 97 fucktard

Re:Clever move (1)

someones (2687911) | about a year and a half ago | (#42842093)

no. win 2000 did not have them.
And it does have nothing to do with the office package but with the system.

Re:Clever move (1)

symbolset (646467) | about a year and a half ago | (#42841871)

It's from my boss. It must be OK. Even if it isn't, I don't dare not read it.

Just remove Flash from office machines (0)

Anonymous Coward | about a year and a half ago | (#42840817)

There's absolutely no reason to have Flash installed on machines in an office. Remove it and give the users regular accounts so it can't be re-installed, and you'll be fine.

Re:Just remove Flash from office machines (3, Insightful)

hawguy (1600213) | about a year and a half ago | (#42840853)

There's absolutely no reason to have Flash installed on machines in an office. Remove it and give the users regular accounts so it can't be re-installed, and you'll be fine.

Except of course, for the web-based trainings that employees have to take that rely on Flash.

Re:Just remove Flash from office machines (1)

sunderland56 (621843) | about a year and a half ago | (#42841219)

Except of course, for the web-based trainings that employees have to take that rely on Flash.

Web-based training is a virus. It both decreases productivity and makes users unhappy.

Re:Just remove Flash from office machines (3, Insightful)

hawguy (1600213) | about a year and a half ago | (#42841289)

Except of course, for the web-based trainings that employees have to take that rely on Flash.

Web-based training is a virus. It both decreases productivity and makes users unhappy.

No arguments here, but tell that to the state of California that requires 2 hours of sexual harassment training for all workers that supervise other employees. The training itself decreases productivity and makes users unhappy, making it web based doesn't make it moreso. A least I can browse the web while clicking through the tedious training with "quizes" with answers that anyone with a modicum of common sense can answer.

Re:Just remove Flash from office machines (1)

spcebar (2786203) | about a year and a half ago | (#42840869)

There's absolutely no reason to have Flash installed on machines in an office.

Slow down there, that's not really fair. Considering that not all offices in the world perform the same work, generalizing that Flash is of no use in any office is sort of counter productive. Flash may be losing its ubiquity, but I can still think of a number of practical uses that aren't cat videos and games.

Re:Just remove Flash from office machines (1)

Anonymous Coward | about a year and a half ago | (#42840921)

Slow down there, that's not really fair. Considering that not all offices in the world perform the same work, generalizing that Flash is of no use in any office is sort of counter productive. Flash may be losing its ubiquity, but I can still think of a number of practical uses that aren't cat videos and games.

Genuinely interested... what would you use Flash for in an office? Not counting people who develop Flash games for work, since they ought to be clueful enough not to get pwned.

Re:Just remove Flash from office machines (4, Informative)

ColdWetDog (752185) | about a year and a half ago | (#42841037)

Genuinely interested... what would you use Flash for in an office? Not counting people who develop Flash games for work, since they ought to be clueful enough not to get pwned.

At least in the medical field, every damned 'training' company, every manufacturer, every news site uses Flash. And uses it poorly. But it's not going away any time soon.

Re:Just remove Flash from office machines (1)

fermion (181285) | about a year and a half ago | (#42840911)

This is why *nix should really be installed on production machines.It can be customized, locked down, and secured in a way that MS WIndows cannot. Years ago, before Apple integrated all the entertainment stuff into the OS, I often argued that APple products were the preferable machine for production work. MS simply included too many toys that were ultimately security risks.

Of couse the expectation quickly became that a 'modern; OS was primarily used as a toy, i.e. Mac OS was inferior to MS windows because it did not have a solid game base.

Re:Just remove Flash from office machines (1)

chronokitsune3233 (2170390) | about a year and a half ago | (#42841011)

As a child, I loved the Math Blaster series of games, and I played them on various versions of Mac OS (Classic). These people who wanted "games" had no idea what value was! Plus if they wanted those sorts of games, there were consoles that looked and performed considerably better!

Re:Just remove Flash from office machines (2)

symbolset (646467) | about a year and a half ago | (#42841885)

I knew the author of Math Blaster. He was a teacher at my high school. I alpha tested pre-release versions for him on the Apple ][. I hope he got the full benefit of his work - he was a great guy. Mr. Smith I believe (yeah, I know. "Smith. Yeah, right.")

Re:Just remove Flash from office machines (0)

Anonymous Coward | about a year and a half ago | (#42841019)

You truly are ignorant. Consider never putting forth your ideas again. They only degrade whatever discussion is occurring.

slaps head (1)

decora (1710862) | about a year and a half ago | (#42841189)

have you heard of 'flashback'?

Re:Just remove Flash from office machines (2)

sumdumass (711423) | about a year and a half ago | (#42841791)

I said that once, then got a stern talking to when one of the partners couldn't watch a video of a dog walking on it's front legs peeing on everything.

You are right, but how do you convince those in charge of it?

I had another place that made their company website so it would only work correctly on internet explorer. The web designer said it come stock on 98% of all computers so it was enough. I solved that issue by telling the CFO to try to surf it on his Iphone and then asked why they would have features for customers who couldn't use whatever device they wanted to and whether or not they are losing any business because of it.

Some issues aren't solved that easily though.

Tango Waltz Whatever (0)

Anonymous Coward | about a year and a half ago | (#42840835)

This is also why i cant believe that Microsoft made jpg and gif files hold executable code themselves. What use case does a picture need to be executable. Anyway data executable has been Microsoft default behaviour since they made software so this is unsurprising. Thats why they are so very often compromised and have the worst ever industry record for compromised software and why i still cant believe anyone still uses their pile of crap.

Re:Tango Waltz Whatever (2)

hedwards (940851) | about a year and a half ago | (#42841301)

It's a moot point because MS decided to hide the file extension from the user and let the file contain the icon for the file.

Re:Tango Waltz Whatever (2)

symbolset (646467) | about a year and a half ago | (#42841891)

It's worse than that. NTFS includes for EVERY file a potentially executable hidden resource fork that can't even be seen without special tools.

what a great idea for a virus (2)

decora (1710862) | about a year and a half ago | (#42840837)

Warning: Adobe has detected this file may be infected. Click here to report this to Corporate IT security and secure your workstation.

Re:what a great idea for a virus (1)

Shavano (2541114) | about a year and a half ago | (#42840841)

Warning: Adobe has detected this file may be infected. Click here to report this to Corporate IT security and secure your workstation.

Does it uninstall Flash, then?

aaand it won't help much (5, Insightful)

v1 (525388) | about a year and a half ago | (#42840843)

"So what's wrong with it?"

"You have the latest flash virus. Have you opened any Word documents lately?"

"Of course! I use Word all day."

(scans hdd, finds the one in email that started it)

"Did you open this?"

"Of course I did. It's the weekly report."

"Didn't it WARN you there may be a virus?"

"Yes it opened up a box I hadn't seen before. But I needed to see the report, so I clicked the Open Anyway button."

"Didn't you get the memo last week about not clicking Open Anyway?"

"Of course I read the memo. But I need to read that report. I had to open it."

aaaand this is why this doesn't work anywhere near as well as Adobe says it will. No matter how many times you tell them to call you and NOT open it anyway, they still will. And you'll be at her desk again. Maybe later today even. Because she opened it anyway, because she "had to". (speaking from experience here)

The only reasonably effective way to implement this is with a policy that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)

Re:aaand it won't help much (3, Insightful)

Darinbob (1142669) | about a year and a half ago | (#42840927)

People sometimes don't realize that people they know may be sending malware (not on purpose), or that someone may be pretending to be people they know. Just because the email is from the head of your church committee doesn't mean it's safe to open the "look at these kitties!" file.

Some people also just click yes to everything. I was helping my mother figure out some new problem on Firefox, which involves telling her the names of a particular menu to choose and the like. And I couldn't figure out why she wasn't find the menus or buttons I was talking about. Then I realized she had updated her Firefox whenever it popped up and said "hey, please update me!", and now she had a UI she was unfamiliar with. This also means she occasionally ends up with google bars or yahoo bars or something else stupid that I have to uninstall every time I visit.

It's not just mothers that do this, I see professionals in the office doing the same thing.

Re:aaand it won't help much (1)

v1 (525388) | about a year and a half ago | (#42841033)

Sometimes you get people who only care about getting their job done. I had to deal with a couple that flat out told me they didn't care if it had a virus in it or not, they needed to open it, and come hell or high water, they were going to open it. Sort of a "reports are my job, dealing with viruses is your job" kind of attitude.

And then the virus traffic detection tags the machine and tells the switch to turn off her port and we get lots of waaaaah.

dealing with viruses is your job (3, Insightful)

decora (1710862) | about a year and a half ago | (#42841197)

welcome to corporate america, you are responsible for shit you have no way to control or to fix.

just like everyone else.

those people who have to open those reports are in the same boat as you. if they dont open the report, then xyz doesnt get done, then a shit storm rolls down the hill and destroys the entire department.

Re:aaand it won't help much (1)

symbolset (646467) | about a year and a half ago | (#42841915)

Usually you get people - quite intelligent, technical, well educated and experience people - who still can't understand why you don't click on the "Stop sending this spam" link in spam, or why they can't have the "Yahoo toolbar" browser add-on installed by some app they downloaded from a some random download portal on the Internet with uncertain provenance, or the prancing horse mouse cursor. But then you have C level executives who don't understand reply-all either also.

Re:aaand it won't help much (0)

Anonymous Coward | about a year and a half ago | (#42842125)

It was kinda funny when the highest level lawyer in a company I was at hit reply all to a corporate wide e-mail tell everyone what was going on this quarter.

Re:aaand it won't help much (1)

Bearhouse (1034238) | about a year and a half ago | (#42841921)

Enable Remote Desktop on your mom's PC. It's not as insecure as people claim, if you do it right.

Re:aaand it won't help much (1)

girlintraining (1395911) | about a year and a half ago | (#42842045)

It's not just mothers that do this, I see professionals in the office doing the same thing.

It's sad you have to point it out before people can see it as sexist. The geek community here didn't used to be quite like that. There were trolls of course, but lately it's become prevalent even in otherwise perfectly good comments... :(

Re:aaand it won't help much (0)

Anonymous Coward | about a year and a half ago | (#42842645)

And you have some people who are either completely retarded or just refuse to listen.
Take this for example:

Each year we do a lifecycle to all the machines within the university libraries. This includes branch campuses and all 6 libraries on our main campus (about 2500 machines). In the past weve used Ghost (or products along those lines) but for the past 2 years for the public (student) machines we've been using IBM Tivoli Endpoint Manager (System Manager/BigFix) so not only can we push individual software updates but we can also wipe the OS and re-install remotely.

This year we've deployed to the staff machines. There's a few sections to how this works. For the initial flash of the machine (new hardware or it hasnt been flashed with sysman yet) you use a thumb drive build key. The formats the hard drive and installs a Pre-Install windows environmen into a hidden partition on the hard drive and saves settings like IP, domain, etc.
The machine then reboots and installs windows on a partition that uses the rest of the hard drive. During this the screen is white and displays whats going on in very general terms. The user can only watch.

The fun begins when the machine reboots. It does 3 or 4 phases of installing software packages or configuring settings, rebooting after each phase. *BUT* during this procress, since its now the actual installed windows running, theres the message of "press control + alt + delete to log on" ON a gray background with a big red stop sign in the lower left of the screen and a message about not using the machine as the build procress is going on (if they do log on it messes up installs since it then tries to do so under there account which prompts for admin privilege escalation.
You wouldnt believe that some people hit ctrl+alt+del even with the screen showing and us telling them not to during that screen, wait until the normal blue bsckground (with no stop sign) is back.

Re:aaand it won't help much (1)

Anonymous Coward | about a year and a half ago | (#42840979)

that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)

Sure. Activate this. 10seconds to the first call of a user "ordering" you to reactivate it, because he/she need's it, 30seconds until your boss get's a call from him/her cause you refused it, 60seconds 'til the department head get's a call from his/her boss, ordering your boss to order you to reenable it.

Re:aaand it won't help much (1)

rudy_wayne (414635) | about a year and a half ago | (#42841215)

that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)

Sure. Activate this.
10 seconds to the first call of a user "ordering" you to reactivate it, because he/she need's it,
30 seconds until your boss get's a call from him/her cause you refused it,
60 seconds 'til the department head get's a call from his/her boss, ordering your boss to order you to reenable it.

You're exactly right, and that's because of the real problem: Word cannot tell if something in a document is malicious or not, so it will display the warning message for all content of that particular type, even if it is perfectly legitimate. And so you are left with an all or nothing choice --

(1) Let people open the documents and take your chances
or
(2) Don't allow users to open ANY document which contains that particular type of content (are you ABSOLUTELY SURE that NOBODY in your company is producing documents with embedded Flash content?)

If you choose number 2 you are guaranteed to experience the scenario described above which will inevitably lead to you right back to number 1.

Re:aaand it won't help much (0)

Anonymous Coward | about a year and a half ago | (#42841109)

And that's the rational user subspecies. Most average drones will click any button they're presented. CONFIRM GLOBAL NUCLEAR WAR button gets instantly clicked. Too many deadly proprietary EULAS and spam popups have been too much for their poor brains...

Even when users are presented an error message, most of them cannot tell you what the message said after 10 seconds in their passionate plea for help. Makes life hard, for everybody.

It would kinda help if people read what the computer is trying to tell you but no. Won't do jack shit is my bet.

Re:aaand it won't help much (0)

Anonymous Coward | about a year and a half ago | (#42841115)

She /did/ have to. You ended up at her desk (again), but not her manager. She only knows something is really wrong to do if her manager shows up. And not opening the report /would/ bring her manager.

She's not wrong. She's doing as trained to do.

Causing you more work isn't her problem. And within the logic that bears down on her job, if you were any good at what you do, there wouldn't be a security problem that makes you come to her desk to clean up. Don't you do a 'firewall' or thingy that protects them?

Yup, facepalm. But it's working logically. She's not the problem. Your authority level is the company in the problem.

Re:aaand it won't help much (1)

DarwinSurvivor (1752106) | about a year and a half ago | (#42841233)

Which is why these applications need administrator-level permissions that let you prevent those warning and instead show an error message (without an "ok" button).

Better yet, corporations could wake up and start demanding their software and infrastructure stop requiring the use of flash player to access their services.

Re:aaand it won't help much (3, Interesting)

rabtech (223758) | about a year and a half ago | (#42841275)

Here's the real version of that conversation:

"So what's wrong with it?"

"You have the latest flash virus. Have you opened any Word documents lately?"

"Of course! I use Word all day."

(scans hdd, finds the one in email that started it)

"Did you open this?"

"Of course I did. It's the weekly report."

"Didn't it WARN you there may be a virus?"

"No"

"I'm pretty sure it popped up and warned you about the security implications of opening documents containing flash applets from untrusted sources"

"What does that mean?"

"It means it warned you about a possible virus"

"Oh, well stuff pops up all the time and I just click OK so the computer will work. Sometimes it pops up again so I click Cancel"

Users are bombarded with dialog boxes, permission boxes, info bars, tray notifications, software update notifications, and so forth all day long. They don't read them, they just click YES/OK. If it pops up again, they try CANCEL (even if the text is different - remember they don't read it!)

That's why IE's ActiveX scheme was a massive failure - it relied on users to know what ActiveX was, know what digital certificates were, then make an informed security decision for each and every control that wanted to install. Even if the native code execution wasn't a huge hole all by itself the whole scheme is a massive failure because most users don't know what ActiveX is, wouldn't know how to verify a certificate if they wanted to, and can't control what the control does after it's installed.

This is also why Android is a huge security fail. It relies on the user to understand what the permissions mean and what the consequences are at the time of install. Even if you understood exactly what those 18 permissions were (including scrolling down to expand the list and finding identically named permissions but with slightly different detail text under them)... you can't enable-disable them if you decide the app shouldn't have some of them. Should App X be able to modify or delete USB storage? maybe... depends on what it wants to do! Should it be able to make phone calls or send text messages? Maybe... too bad you won't be asked about it when it signs you up for $9.99/mo SMS services. What about manage accounts? Maybe the app wants to legitimately manage accounts... or maybe it will delete your entire google account. Who knows, but you sure won't be prompted about it.

Any system that relies on the user to make potentially dangerous security decisions is an automatic failure; doubly so if the decision is irreversible and persistent for all time (which covers the vast majority of security systems in use today).

I'm almost certain that in the future we'll grant permissions to different apps and websites by answering at the time the app wants access to the resource, not forever. Further I think the system will want to keep a history (think git, but for the entire filesystem), allowing you to effectively "roll back" a bad security decision. That probably means browsers and apps all run isolated in their own OS-provided VM/sandbox and all sharing or filesystem access routes through the version control system.

Re:aaand it won't help much (1)

0123456 (636235) | about a year and a half ago | (#42841387)

I'm almost certain that in the future we'll grant permissions to different apps and websites by answering at the time the app wants access to the resource, not forever.

Like UAC's wonderfully helpful popups, you mean?

'Application Hello Kitty Screensaver wants to: Access Hard Disk. Allow/Deny?'

Yeah, that's going to make life much easier for Joe Know-Nothing to avoid malware. They'll click yes to everything, then disable it after ten minutes because it's popping up all the time.

The only way it can work is to sandbox every app so it can't infect any files but its own. Even then, it also needs a network sandbox so it can't connect to arbitrary network services.

Re:aaand it won't help much (1)

tlhIngan (30335) | about a year and a half ago | (#42841859)

Users are bombarded with dialog boxes, permission boxes, info bars, tray notifications, software update notifications, and so forth all day long. They don't read them, they just click YES/OK. If it pops up again, they try CANCEL (even if the text is different - remember they don't read it!)

The technical term for it is dancing pigs [wikipedia.org] (or Dancing Rabbits).

The premise is that any security that relies on getting in the user's way of a task will be promptly bypassed. The user will always choose dancing rabbits/pigs/whatever over security every time.

what counts for lolcats and porn in China? (0)

Anonymous Coward | about a year and a half ago | (#42842053)

Related to dancing pigs [wikipedia.org] is the cute cat theory of digital activism [wikipedia.org] which suggests that China "circumvent[s] the cute-cat problem because the government is able to provide people with access to cute-cat content on domestic, self-censored sites while blocking access to Western sites". So the question is: what counts for lolcats and porn in China and does it differ substantially from Western sites?

Re:aaand it won't help much (1)

amoeba1911 (978485) | about a year and a half ago | (#42842647)

This is exactly what I was going to post, I searched to see if anyone had posted the dancing rabbits problem yet and there it is.

If you leave it up to the user to decide whether or or not to bypass the security protocols, then you have no security protocol. It's like getting the most secure door installed on your house but allowing your 4 year old to open the door to strangers.

Re:aaand it won't help much (1)

_Ludwig (86077) | about a year and a half ago | (#42841845)

"And now you need to be out of commission for at least an hour so we can fix your computer that you broke. I'm sure your manager will understand."

Re:aaand it won't help much (1)

DaveGod (703167) | about a year and a half ago | (#42842635)

Did it occur to you that maybe she did actually need to open the weekly reports and that the policy was not fit for purpose? The story seems intended to imply the ignorance of the user but I'm left questioning the ignorance of the IT guy.

"Just show me auntie's e-card!" (3, Interesting)

chronokitsune3233 (2170390) | about a year and a half ago | (#42840991)

"This document contains macros which may harm your computer. Do you wish to allow them to run?" (Clicks "Yes" blindly.)

Some (or maybe all...IDK) Word documents that were actually templates contained macros in the absence of an actual wizard. This meant that in versions of Office that recognized the security hazard, you got a pop-up before the document actually opened. I personally clicked "Yes" or "Open Anyway" or "Allow" or whatever it said without even bothering to read it because I usually got the document from a trusted source (as in someone I trust, not someone a company/corporation trusts using an actual whitelist/blacklist). I presume many got tired of seeing the message as I did, and they did the same thing. Similar events will probably happen with this Flash issue. Your aunt sent you an e-card for your birthday from her virus-infested computer? Sweet! Allowed!

And before people ask, yes I was speaking in the past tense. I no longer use Microsoft Office, in favor of Google Drive's Office-like features that started out as "Google Docs & Spreadsheets". It may not be as full-featured, but I don't need it to be either.

Re:"Just show me auntie's e-card!" (4, Informative)

v1 (525388) | about a year and a half ago | (#42841089)

Macro viruses were annoying also. For awhile Word/Excel gave you only one check box in security prefs, to pop a dialog when a document contained macros. (you could not disable them, only turn on the dialog)

Then when the user opened a doc with a macro (or more often, a virus) it would pop and give just TWO options... (A) open and run macros, or (B) do not open.

Gotta love microsoft for that one. Took them insane ages to add the (C) Open with macros disabled. Until then we had to deal with the "but I HAD to open it" people. But then I could continue to bash on them for not having a "flush macros" button anywhere, and the ability to create a "hidden" macro, and every macro virus creator's all-time-favorites, the "run on open" and "copy macro to other closed document" options. But that's drifting somewhat OT.

Re:"Just show me auntie's e-card!" (0)

Anonymous Coward | about a year and a half ago | (#42841329)

Mod parent up!

I wish I'd saved another mod pt for this but I just used my last one on another posting of yours here (posting as AC so I don't undo it). Cheers!

Better answer... (1)

jonwil (467024) | about a year and a half ago | (#42840995)

Stop allowing Flash to be embedded in things like Word documents and PDF files.
I have yet to see a single valid use of Flash in PDF or other document formats that couldn't be done as a web page instead.

Re:Better answer... (1)

rudy_wayne (414635) | about a year and a half ago | (#42841049)

Stop allowing Flash to be embedded in things like Word documents and PDF files. .

This is the correct answer. Yes, Adobe needs to get their shit together and stop producing software with new security flaws being discovered almost daily. But what about Microsoft's responsibility? Flash embedded in a Word document? What.The.Fuck

Re:Better answer... (2)

hedwards (940851) | about a year and a half ago | (#42841323)

Well, didn't MS pretty much invent documents as an attack vector. Perhaps my memory isn't so good, but the first cases I remember of that were for Word.

Re:Better answer... (1)

cellocgw (617879) | about a year and a half ago | (#42842653)

But what about Microsoft's responsibility? Flash embedded in a Word document?

Yeah, not to mention the idiotic capability to embed entire Office documents inside other Office docs. I knew people who thought this was far better than, say, a nice zip archive. I used to get even by doing helpful things like converting a Word doc to PDF (try opening that embedded spreadsheet NOW, Dr. Doom!), or embedding a PowerPoint doc in a Word doc., embedding that Word doc in an Exel workbook, etc. in an EmbeddedTurtles Allthe Way Down sequence, and giving that back to them.

Meanwhile Gnash (3, Interesting)

Ceriel Nosforit (682174) | about a year and a half ago | (#42841053)

Meanwhile Gnash supports Youtube just fine, which remains Flash's sole legitimate use.

It even supports audio out of the box.

Re:Meanwhile Gnash (1)

jfengel (409917) | about a year and a half ago | (#42841103)

Is it demonstrably more secure? Or is it just too obscure for anybody to target?

Re:Meanwhile Gnash (1)

Ceriel Nosforit (682174) | about a year and a half ago | (#42841173)

I don't have an authoritative answer, but Chromium keeps telling me Adobe Flash is out of date with its bright yellow Load Anyway dialogue. I see that bar on a lot of sites which should not have any reason to use SWF, even though adblock removes the worst offenders.

Re:Meanwhile Gnash (1)

tlambert (566799) | about a year and a half ago | (#42841977)

I don't have an authoritative answer, but Chromium keeps telling me Adobe Flash is out of date with its bright yellow Load Anyway dialogue. I see that bar on a lot of sites which should not have any reason to use SWF, even though adblock removes the worst offenders.

Flash is often embedded in web pages with no UI in order to implement "super cookies" (LSO's or Local Shared Objects) in order to be able to track you even if you have cookies disabled, since people want to be able to see their videos. So they leave Flash enabled.

The workaround for the user is to install something like "ClickToFlash", but that can get annoying pretty fast, especially on sites like abc.com or cbs.com, which have very short timeouts on reading the data back out, and so claim you have flash disabled, even though you don't, because you don't click in under a second. So you enable the bypass for that website, and they are back to tracking you again.

Re:Meanwhile Gnash (1)

mister_playboy (1474163) | about a year and a half ago | (#42842417)

You can deal with super cookies by using an add-on like FF's BetterPrivacy.

Even more basically, you can make Flash's hidden .adobe and .macromedia folders read-only.

Re:Meanwhile Gnash (1)

Boltronics (180064) | about a year and a half ago | (#42842511)

...and that's when you use something like BetterPrivacy (in Firefox at least). http://fixtracking.com/ [fixtracking.com]

Re:Meanwhile Gnash (0)

Anonymous Coward | about a year and a half ago | (#42841157)

how about hulu.com?

Re:Meanwhile Gnash (2)

Ceriel Nosforit (682174) | about a year and a half ago | (#42841183)

Says "...currently our video library can only be watched from within the United States." Can't be bothered to find a local TOR exit...

Re:Meanwhile Gnash (0)

Anonymous Coward | about a year and a half ago | (#42841309)

hulu isn't legitimate? mainstream flash game? flash embedded in office documents -- that's what is not a legitimate use of flash. why the hell is that even allowed in the first place?

Re:Meanwhile Gnash (2)

tepples (727027) | about a year and a half ago | (#42841327)

Youtube [...] remains Flash's sole legitimate use.

Is there a reason that you feel that showing web animations (such as Homestar Runner or animutations) without converting to MP4 and thereby bloating the download size by a factor of 10 is not "legitimate"

Re:Meanwhile Gnash (1)

VortexCortex (1117377) | about a year and a half ago | (#42842105)

Are you saying that you'll play those legitimate animations written in ActionScript (a flavor of ECMAScript) in a Flash format outside of a web browser that already supports JavaScript (a flavor of ECMAScript) and Vector Graphics? Adobe hates Flash. They make money making tools that create flash content, and they would MUCH rather simply sell the same tools and generate HTML5 content with them instead. Same revenue, no cost to maintain the "player" becuase it's in the damn browser. You can even embed JavaScript in HTML documents......

Not him, but Flash has no legitimate use. IMHO, neither does JavaScript, but that's beside the point.

you Fail it (-1)

Anonymous Coward | about a year and a half ago | (#42841055)

What you get for not using Libre software... (0)

Anonymous Coward | about a year and a half ago | (#42841099)

You wouldn't have this sort of issues if you were using liberated/free (as in speech) software. Adobe allows their third party shills to pollute their software so they also become a shill. Whenever I see a computer with flash, I resolve to format and repurpose it immediately.

People using M$ Office are just sheeple who deserve everything they get.

A solution... (1)

noobermin (1950642) | about a year and a half ago | (#42841147)

to the problem of liability.

Minitube does not use the Flash Player (2, Informative)

Anonymous Coward | about a year and a half ago | (#42841339)

http://flavio.tordini.org/minitube [tordini.org]

Linux, Mac OS X, Windows

"Light on your computer. By consuming less CPU, Minitube preserves battery life and keeps your laptop cool. That's because Minitube does not use the Flash Player.

High Definition. Minitube plays HD videos up to 1080p. Go full-screen and watch them play smoothly.

1-Click Downloads. Download your favorite clips to your computer and put them on your portable device. Downloaded files are in MPEG4 format which is compatible with most devices, including Apple ones.

Stop fiddling. Just search for something. Minitube automatically plays videos one after another. Sit back and enjoy."

http://packages.ubuntu.com/quantal/minitube [ubuntu.com]
http://packages.debian.org/sid/minitube [debian.org]

Re:Minitube does not use the Flash Player (1)

Skapare (16644) | about a year and a half ago | (#42841361)

Where are the 64 bit binaries? But more importantly, where is the source code?

Re:Minitube does not use the Flash Player (2, Informative)

Anonymous Coward | about a year and a half ago | (#42841383)

for Linux - it should be posted on their site.

Even more importantly, where is the source code for Adobe Flash?

Re:Minitube does not use the Flash Player (0)

Anonymous Coward | about a year and a half ago | (#42841551)

mod parent up!

Yes another popup message is the fix! (3, Insightful)

chopthechops (979273) | about a year and a half ago | (#42841373)

After 18 years or so of increasingly frequent popup messages appearing in popular software you would think everyone realises by now how useless they are. Normal users don't read popups, and those who do read them don't know or care what they mean, and/or they just choose to ignore them. Actually I think software vendors know exactly how useless they are, and in the case of security-related popups it's just the vendor saying "security is the end user's problem, not ours". Kinda like the warnings you get on cigarette packets.

Office 2008? (2)

idontusenumbers (1367883) | about a year and a half ago | (#42841481)

"To protect users of Office 2008 and earlier"

Refer to Office 2008 then post a Windows screenshot? Par for the course I suppose.

And fluffy bunnies (2)

Ralph Spoilsport (673134) | about a year and a half ago | (#42841491)

will protect all the unicorns.

* Hopes popup warnings will stop * attacks (5, Insightful)

Chas (5144) | about a year and a half ago | (#42841611)

Sorry.

It doesn't happen that way.

It just doesn't.

They tried this with browsers. It was egregiously cumbersome and conditioned people to auto-click YES to everything.

They tried this with Windows. It's still egregiously cumbersome and is still just conditioning people to blindly auto-click YES to everything.

So...NOW...they're adding MORE crap to click YES automatically to?

Third time's the charm?

FUCK NO!

Three strikes and you're out fuckers!

Warning popups prevent a small amount of infestations up front.
HOWEVER, down the road, as people get conditioned to the popups, they just click past without looking. Because the popups ARE IN THEIR WAY.

Adding a stupid popup is basically an admission that they're too goddamn stupid or lazy (or both) to secure their software properly. Or that their software is, inherently not secure or not able to BE secured.

At which point, it's crap that needs to be replaced with a better solution. Even if it means giving up the convenience of "Well this works right now".

Re:* Hopes popup warnings will stop * attacks (0)

Anonymous Coward | about a year and a half ago | (#42842023)

And that's why I install Chrome to my parents computer, it doesn't show dialogs for updating. Unlike Firefox, which still throws those.

Also I'm considering Chrome OS for their next computer, it should do all the updates automatically.

Re:* Hopes popup warnings will stop * attacks (0)

Anonymous Coward | about a year and a half ago | (#42842665)

Do you have some numbers to back up the notion that everyone eventually ignores warning messages and that they do absolutely no good? Adobe hasn't spun this as a perfect solution. It's there to help improve the problem. In all likelihood, it will. People aren't often presented with popups when opening Word documents. It will stand out as unusual, and if you look at the UI design of the message box, it's not something where they can blindly click a button to continue. They have to read it, change the radio button selection, and then click Continue to screw themselves. In other words, Adobe already thought of what you're talking about and adjusted for it.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>