Hello

I was listening to the knightwise podcast @ http://knightwise.com/kw801-cross-platform-security/

In this episode, they were talking about viruses and malware and how all platforms including linux is not immune to it. They also discuss how our systems get can get infected.

They also discuss how flash and java can have exploits or holes to execute malicious code.

This concerns me because I visit websites with flash and since adobe stopped supporting linux, we are using flash 11.2.x which is dated.

I have a question and it may be dumb as I don't nothing about flash exploits or java programming.

Can a bad website's flash/java execute malicious code on our systems or they only affect browsers? Thanks

cheerios

Personally I no longer install flash or java on any of my computers for this exact reason. Living without flash has been a pain in the neck at the beginning, but I've learned to endure it. It's still troublesome because certain websites are being dickheads and refuse to play their video content without flash plugin installed i.e. twitch.tv (I learned to bypass it by using livestreamer).

Anyhow, if you absolutely must have these plugins installed you can use a firefox browser addon like NoScript that will block them by default. You will have to click on a placeholder to activate the plugin on a given website - this will prevent some hidden parts from automatically executing and possibly running malicious code, but can also break some websites. It still doesn't protect you 100% because an attacker can simply replace the flash container on a trusted website with his own malicious one (mitm).

1 members found this post helpful.

Thanks displace

I believe websites should stray away from flash and use html5 video tags and play mp4/mp3/ogg/ogv media as to flash. At least, youtube includes html5 and other media formats.

I once was tempted to try gnash instead, but I read and heard it isn't compatible with some sites and it can be buggy and/or unstable.

As for java we can only hope that something better would replace it.

cheerios

Yes! Because flash & java have tons of security exploits.

I recommend that people use e.g. Privoxy and AppArmor.

1 members found this post helpful.

I don't use java or flash because they are insecure. However, if I do have to use flash in some rare cases, I make sure to use NoScript to disable flash on all sites but the one that I have to use it on. It is usually not installed or disabled.

1 members found this post helpful.

+1 Addons: NoScript and Adblock... plus over all system security is you, I like Firewalld too.

Firefox 26/27 can disable plugins without NoScript or other addons. NoScript is still useful for controlling JavaScript and other potentially dangerous stuff but it may be tedious to configure as far as I remember.

1 members found this post helpful.

You configure it once and forget about it. Helps a lot with online security from what I've seen. No more browser hijacking by malicious sites using javascript. The sites that break are either malicious or badly coded, from what I've seen.

2 members found this post helpful.

any content that needs interpreter (flash, shockwave, html, script, images, etc etc) is susceptible to potential vector of attack.

basic 101's, if you dont need "it" to do the business function, then disable or remove "it".

for personal use, the more shiat you have running/enabled the more susceptible your platform is to attack.

the more popular something is (like java, windoze, flash) the more it becomes a target.

2 members found this post helpful.

If you don't want NoScript for some reasons, you can use flashblock instead to just block flash until you click on it.

1 members found this post helpful.