By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    An Android that robbed your bank account -Kaspersky Daily
    8 months ago
    New CryptoLocker-like Malware for Android
    8 months ago
    Apple Watch And The Other Smartwatches
    8 months ago
    Latest News
    Safeguards against firmware signed with stolen MSI keys
    1 day ago
    WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
    1 day ago
    Wordfence Intelligence Weekly WordPress Vulnerability Report (May 15, 2023 to May 21, 2023)
    6 days ago
    Wordfence Firewall Blocks Bizarre Large-Scale XSS Campaign
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    How To Configure Cloudflare To Maximize WordPress Speed + Security
    7 months ago
    Windows 11 build 25179 rolls out in the Dev Channel
    8 months ago
    How to set a static IP address on Windows 11
    8 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    4 months ago
    Now you can speed up any video in your browser
    4 months ago
    How to restore access to a file after EFS or view it on another computer?
    4 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    5 months ago
  • How To
    How ToShow More
    What is two-factor authentication | Kaspersky official blog
    2 days ago
    Acer refreshes Windows 11 PCs for work and play: Swift Edge 16 and Predator Triton 16
    4 days ago
    NVIDIA GeForce RTX 4080 New Mercury Editions of Razer Blade 16 and Blade 18 now available
    4 days ago
    How Oxy uses hooks for maximum extensibility
    How Oxy uses hooks for maximum extensibility
    5 days ago
    The personal threat landscape: securing yourself smartly
    5 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    How to enable dark mode for new Outlook app on Windows 11
    3 weeks ago
    New Fraud in India with porn deepfakes
    8 months ago
    Google My Business Temporarily Removes Features Due to COVID-19
    8 months ago
    Latest News
    How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
    2 days ago
    How to enable Taskbar End Task option to close apps on Windows 11
    2 days ago
    How to check USB4 devices specs from Settings on Windows 11
    2 days ago
    How to enable new header UI for File Explorer on Windows 11
    1 week ago
  • Glossary
  • My Bookmarks
Reading: A patent to catch exploits
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
AppsThreatsWordpress Threats

A patent to catch exploits

Vitus White
Last updated: 13 October
Vitus White 4 years ago
Share
7 Min Read

Tell me what you think of Adobe Flash and I’ll tell you if you work in cybersecurity. To most people, Flash is something that your browser asks you to update before it will play a viral video. Tech-savvy folks are apt to fly into a rage at the merest thought of the insecurities in the platform, the easy opportunities to wreak havoc.

Contents
How are Flash exploits different?So a virtual machine makes Flash secure?If you can’t rely on filenames, and the virtual environment isn’t secure, what can you do?If it looks like an exploit…

In fact, Adobe Flash topped our list of 2015’s most-exploitable programs. You’ll find a few other popular names close to the top, namely Java, Adobe Reader, and Microsoft Office and Silverlight. But Flash packs the triple punch of being extremely popular, heavily affected by vulnerabilities, and not as regularly updated by users as it should be.

With that in mind, we are very pleased to announce that Kaspersky Lab has been granted a patent for technology that is of particular help combatting the kind of exploits that affect users of Flash in particular.

BadUSB: problem solved -> https://t.co/Qx890SNJfw pic.twitter.com/MdJ8e1Q4ij

— Eugene Kaspersky (@e_kaspersky) July 8, 2016

How are Flash exploits different?

We’re glad you asked. To answer simply, we need to invoke a small bit of history. Basically, there are only two ways to infect your PC. The first method needs your direct involvement: downloading and running an executable, opening a document with malicious macros, clicking on a malicious URL, that sort of thing.

The second method does not require you to do anything at all. In this scenario, cybercriminals find and exploit a vulnerability in your operating system or one of programs you have installed and used. If a browser has a vulnerability, for example, just opening a single malicious web page might be enough. (Readers of Kaspersky Daily will not be surprised that malicious websites are truly abundant).

The easiest way to infect a PC is over the Internet, so website exploits are extremely popular among cybercriminals. They don’t necessarily exploit vulnerabilities in browsers; they often gain entry to Java or Adobe Flash Player components, which are responsible for multimedia playback on a website.

#exploit kits spreading attacks for recent #Flash player zero day via @threatpost https://t.co/0s3GOKldGz pic.twitter.com/H5029jCqd1

— Kaspersky Lab (@kaspersky) May 23, 2016

Think of Flash videos not as files that open in a program but as actual programs. They are downloaded together with the other contents of a website, but then they execute separately, with help of the Adobe Flash component installed in your system. However, the process is a bit more complex. To run these programs safely, Adobe Flash executes them in its own virtual environment — in other words, these programs are run on a simulated computer inside your computer.

So a virtual machine makes Flash secure?

Great question! Flash executes files in a protected virtual environment because running code from all over the wilds of the Internet is risky. Running all code within a virtual machine means that if any code downloaded from the Internet attempts to do anything on your computer, it cannot access your files and documents — or critical operating system components. But that is true only in theory. In reality, exploits can bypass Flash’s security measures (e.g., virtualization) — by using vulnerabilities in Adobe Flash.

Wait for it… #Adobe patches 52 #flash vulnerabilities via @Mike_Mimoso https://t.co/qyhs7rY2b8 on @threatpost #IT pic.twitter.com/Qu8D4MeLpp

— Kaspersky Lab (@kaspersky) July 12, 2016

There is another issue: The very nature of the file and of the Flash virtual machine makes them a very convenient environment in which to hide threat actors’ intentions from the system. It’s even possible for hackers to create a unique file for each victim.

That represents a particular problem for traditional antivirus detection, which relies on enormous lists of files to detect malware. All these millions of exploits work the same way, but to a security solution, they seem to be different. Moreover, Adobe Flash programs can be written in any of three programming languages, and that point introduces additional complexity to the system responsible for detecting malicious content among legitimate Flash content.

If you can’t rely on filenames, and the virtual environment isn’t secure, what can you do?

That is a question that has stumped the security community for quite some time. We needed a way to identify the malicious nature of code before executing it. In theory, we could run the program in our own virtual machine before relaying the code to Adobe Flash, but that approach is too complex and resource-intensive for practical, everyday use. Even if it took only a fraction of a second, people are used to instant gratification online.

If it looks like an exploit…

That’s where Kaspersky Lab’s new technology comes in. Created by Anton Ivanov and Alexander Liskin and based on the emulation of suspicious code, our method takes less time to analyze a multitude of similar objects with small differences. The developers of the method used the virtual stack machine approach, not to run code but to gather intelligence about it.

As it turned out, malicious Flash objects needn’t be run to expose their true nature. Even the modifications that malware developers introduce to almost each sample of a code cannot hide the program’s malicious intentions, if we apply our method.

Ultimately, so long as we know one method of exploiting Flash, we can automatically block all malware that uses the same method. Once we integrated this technology into Kaspersky Internet Security and Kaspersky Total Security, our detection rate for these specific threats doubled.

One last piece of history, for perspective: Antivirus companies all struggle mightily to increase their detection rates by fractions of a percent; doubling the rate is nothing short of stunning.


Source: kaspersky.com

Translate this article

TAGGED: Malware, Microsoft, Microsoft Office, Networking, Security, Software, Threat, Threats, Vulnerabilities
Vitus White October 13, 2022 September 30, 2019
Share this Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Safeguards against firmware signed with stolen MSI keys
Threats 1 day ago
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
Wordpress Threats 1 day ago
How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
News 2 days ago
How to enable Taskbar End Task option to close apps on Windows 11
News 2 days ago
How to check USB4 devices specs from Settings on Windows 11
News 2 days ago

Recent Posts

  • Safeguards against firmware signed with stolen MSI keys
  • WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
  • How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
  • How to enable Taskbar End Task option to close apps on Windows 11
  • How to check USB4 devices specs from Settings on Windows 11

You Might Also Like

Threats

Safeguards against firmware signed with stolen MSI keys

1 day ago
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
Wordpress Threats

WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin

1 day ago
News

How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11

2 days ago
How To

What is two-factor authentication | Kaspersky official blog

2 days ago
Show More

Related stories

How to Use Cloudflare to Secure Your WordPress Site
How To Starting Chrome from the command line
How to fix error 0x80070057 in Chrome?
Windows 10 How To Disable Slide to Shutdown
Windows search not working (FIX)
How to watch movies and TV series for free on Kinopoisk?
Previous Next

10 New Stories

What is two-factor authentication | Kaspersky official blog
Acer refreshes Windows 11 PCs for work and play: Swift Edge 16 and Predator Triton 16
NVIDIA GeForce RTX 4080 New Mercury Editions of Razer Blade 16 and Blade 18 now available
How Oxy uses hooks for maximum extensibility
The personal threat landscape: securing yourself smartly
Wordfence Intelligence Weekly WordPress Vulnerability Report (May 15, 2023 to May 21, 2023)
Previous Next
Hot News
Safeguards against firmware signed with stolen MSI keys
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
How to enable Taskbar End Task option to close apps on Windows 11
How to check USB4 devices specs from Settings on Windows 11
10alert.com10alert.com
Follow US

© 10 Alert Network. All Rights Reserved.

  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?