Jun

7

Flash flaw zero day exploit in the wild includes keystroke logger

June 7, 2010 | Leave a Comment

Pac IT Pros members: You should be aware of an Adobe Flash flaw zero day exploit.  This vulnerability was discovered in the wild and includes a keystroke logger.  What this means is if one of your users plays an infected Flash video/PDF the cyber-criminal can (and has) record keystrokes for bank account logins and more.  This is a huge vulnerability.  It affects ALL versions of Adobe’s Flash player on ALL operating systems.

 Link to Adobe’s advisory on this issue.

http://www.adobe.com/support  /security/advisories/apsa10 -01.html

 Adobe has NOT released a fix.  The best you can do is install the beta for the next version of Flash http://labs.adobe.com/techno logies/flashplayer10/

or on Windows disable the Flash player DLL by renaming it.

Just rename authplay.dll to authplay.xxx  The DLL is typically found at:

C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll for Adobe Reader C:\Program Files\Adobe\Acrobat 9.0\Acrobat\authplay.dll for Acrobat.

When Adobe releases the fix, just install and the new authplay.dll will be installed.

 Other items of interest.

I picked up an Evo phone from Sprint on Friday, it you are looking at smart phones, take a look.  Unlike AT&T which is implementing a cap on data, Sprint when on 4g removed the cap.  The phone (in my opinion) is great and I found all the apps I has on my iPhone.  If you defect you can use DoubleTwist which is free as a replacement to iTunes.

 Apple making an announcement today at 10.  It’s either going to be the new iPhone (with minor enhancements or that iPhones will be available on Verizon.  (Before buying you next iPhone, I encourage you to take a look at the Evo or other smart phones running Android operating system.

 I’m at Microsoft’s TechEd this week, I’ll keep you posted with news from Microsoft.

 Doug


Comments

You must be logged in to post a comment.

Name (required)

Email (required)

Website

Speak your mind