Security News Nine Days Later, Flash Zero-Day CVE-2016-4117 Already Added to Exploit Kits

[Alkajak]

Content source

http://news.softpedia.com/news/nine-days-later-flash-zero-day-cve-2016-4117-already-added-to-exploit-kits-504356.shtml

Full Article: Nine Days Later, Flash Zero-Day CVE-2016-4117 Already Added to Exploit Kits

It took crooks less than two weeks to weaponize the most recent Flash zero-day, which they're now using as a module inside the Magnitude exploit kit.

 

[hjlbx]

To cover yourself against the newest Flash exploits, just use an anti-exploit - like HMP.A - and\or run Flash with limited file system and registry access rights - like with AppGuard.

An anti-exploit prevents the exploit in the first place.

Using limited rights prevents the exploited program payload or in-memory process from making changes to the system.

Whether you block the exploit itself or the persistent changes to the system, either way, the system is protected.

I don't know what the big deal about exploits is all about since preventing them is quite simple.

99.9% of the time just keeping your softs up-to-date is sufficient to protect the system all by itself - without any additional security measures or softs.

You can get the level of protection even higher by not using commonly exploited apps = "reducing your attach surface."

The risk of zero-day exploits is minuscule.

 

[Myriad]

I don't know what the big deal about exploits is all about since preventing them is quite simple.

Very well said !

The biggest security risk , by far , is not in the machine .... it is sitting in front of it !
.... that's my opinion anyway .

Almost every time I deal with malware on someone's computer I hear the same questions .....

" Should I change my AV , or download something extra ? "
" Is it better to upgrade to the paid versions ? "

And I end up giving the same reply .... some simple rules :-
1. Do NOT login as admin
2. Do NOT login as admin
3. Don't forget to obey rules 1 and 2

But people seem really opposed to doing this , and I can't put my finger on it ....
.... it's as if you were saying " you are not allowed to use sharp things without a grown-up "

.... just a personal view

 

[Entreri]

I stop using Flash, but Java is no less dangerous. Flash is full of holes.

I recently got malware, Java based, from a reputable site, which is why I enabled Java for that site (NoScript). Not to mention I had Adblock Plus on.

My AV should have stopped it the way I set it up, plus I was using a Local Win10 account and Firefox was the latest version. Sneaky little piece of malware...Fortunately I had Wireshark and plenty of 3rd party scanners. Call me paranoid

I am impressed with these malware writers.

 

[jamescv7]

Honestly these common zero day exploit does not necessarily mean easily it is infected the users, they can appear on some often if something went wrong.

The simple is just update the program regularly then good to go.