Anthony LaForge, Technical Program Manager at Google:
“Later this year we plan to change how Chromium hints to websites about the presence of Flash Player, by changing the default response of Navigator.plugins and Navigator.mimeTypes. If a site offers an HTML5 experience, this change will make that the primary experience. We will continue to ship Flash Player with Chrome, and if a site truly requires Flash, a prompt will appear at the top of the page when the user first visits that site, giving them the option of allowing it to run for that site.”
And that Mozilla and Microsoft will follow. One down… two to go.
Here’s the article, reprinted from the report.
Malware exploits have been a commodity for more than a decade. So much so that during 2006, the day following Microsoft’s monthly “Patch Tuesday” began to be jokingly referred to by InfoSec analysts as “Exploit Wednesday”. Quick turnaround was the key to success. On Tuesday, Microsoft released its updates which were then quickly reverse engineered in order to discover the underlying vulnerability. And then, once the vulnerability was known, an exploit was crafted for use in malware attacks, which aimed to hit those who had not yet updated.
In late 2006, malware became further commoditized with the advent of malware kits. Early kits such as MPack were victims of their own success, unable to scale rapidly to meet the ever-growing demand. But such growing pains were soon enough overcome by malware services and today there are numerous exploit kits available via underground markets.
Exploit Wednesday is no longer a thing. Microsoft’s software[¹] is far more secure than it was 10 years ago and its patches roll out much more quickly. Exploit kits moved on from Microsoft to Adobe. Reader was the biggest target for a time (also Flash). But browsers began to offer native PDF support and Reader became unnecessary for most. Adobe adopted strong update cycles and its software moved, for a time, out of harm’s way. Then Java’s browser plugin became the favorite target — the weakest of the herd. Browser developers more or less forced it into a very restricted place.
And so at the moment… Adobe’s Flash is the last “best” plugin still standing for exploit kits to target. But for how long?
On April 29, 2010, Steve Jobs published an open letter called “Thoughts on Flash” explaining why Apple would not allow Flash on iOS devices. Many technology analysts point to this as the beginning of the end for Flash Player, at least on mobile devices. This proved to be true. On June 28, 2012, Adobe announced there would be no certified implementations of Flash Player for Android 4.1 and it would limit installations via Google Play on August 15th 2012 [²].
Flash has since hung on to its desktop market, but everywhere you look, it’s being deprecated. In August 2015, Amazon announced that “Beginning September 1, 2015, Amazon no longer accepts Flash ads.” Google followed Amazon’s lead in February 2016. Its ad networks, AdWords and DoubleClick, will no longer accept Flash-based display ads starting from June 30th, 2016. They’ll disable Flash-based ads on January 2nd, 2017.
It’s at this point that I’ll make the following prediction for early 2017 — once it no longer needs to support Flash-based ads — the Google Chrome browser will start aggressively forcing users to whitelist sites that require any sort of Flash. Mozilla’s Firefox and Microsoft Edge will do the same, and by spring of 2017… Flash will be effectively decapitated as far as exploit kits are concerned.
Exploit kits face a disruptive future without much new fruit in sight. Commoditized malware services will turn even further toward the use of malware attachments such as the macro-based malware that is currently trending.
If only we could keep people from clicking “okay” to make the box go away.
[¹] Silverlight is a general exception, it is currently exploited by kits. But hopefully Silverlight will soon go extinct as Netflix is dumping the technology.
[²] Ironically, a great deal of Android malware is pushed at people via deceptive ads claiming that a Flash update is required. Even when there is no Flash, its legacy provides a social engineering vulnerability. Google’s search engineers are beginning to configure Chrome to warn about sites that display such ads.