Attackers are using a known zero-day exploit to take crash systems and take control of the infected system. This was discovered by TrendMicro researchers while following the long-running cyber-espionage by a cyber-attackers known by the name Pawn Storm. They are known to target high-profile targets like foreign affair ministers from around the globe to expose domestic spying campaigns by these ministries.
These attacks are received in form of phishing e-mails that contains links leading to the exploit. Defense against these exploits even for Adobe is very difficult as they are quickly implemented and easily disturbed
Adobe has officially announced that their latest Adobe Flash version has a critical vulnerability which could allow the attacker to take control of the affected system.
Affected software versions
- Adobe Flash Player 19.0.0.207 and earlier versions for Windows and Macintosh
- Adobe Flash Player Extended Support Release version 18.0.0.252 and earlier 18.x versions
- Adobe Flash Player 11.2.202.535 and earlier 11.x versions for Linux
The immediate way to defend yourself is to disable Flash but that too is risky. Most browsers do follow the 'Click to Play' feature when a Flash element is displayed on the page, this is safe as it would block Flash from being played on your system. But if the attacker manages to force you to enable Flash for certain content, it doesn't stay safe anymore. The most safe and effective method to handle this is to uninstall Flash from your system. This might affect playing some elements of a few websites but most websites won't be affected. Even YouTube by default chooses to play the video in HTML5 video player over Flash.
As mentioned before Adobe Flash will be patched soon, a patch will be released on October 19th 2015 which should patch this exploit.
Source : TrendMicro Labs
