| This is a daily column written by Lowell Heddings, the founder and owner of How-To Geek. If you prefer, you can read this column in a web browser instead.
How to Protect Yourself from Security Holes in Adobe Flash (and Other Plugins) 
Just a few days ago I was telling you that disabling browser plugins is the most important thing you can do to keep yourself safe, and today Trend Micro announced yet another zero-day, unpatched exploit for Adobe Flash. It’s seriously time to disable plugins, or at least set them to click-to-play mode. New Adobe Flash Zero-Day Used in Pawn Storm Campaign Trend Micro researchers have discovered that the attackers behind Pawn Storm, the long-running cyber-espionage campaign, are using an Adobe Flash zero-day exploit code for their attacks. The particular affected vulnerability is still unpatched, making Flash users vulnerable to attacks. In this most recent campaign of Pawn Storm, several Ministries of Foreign Affairs received spear phishing e-mails. These contain links to sites that supposedly contain information about current events, but in reality, these URLs hosted the exploit.
What’s interesting about this attack is that it was a targeted attack involving faked emails (that probably looked like they came from a believable source) that then loaded a page that contained the exploit kit, which used a security hole in Flash that hasn’t been patched yet, because until this attack happened, nobody knew that the security hole even existed (which is why it’s called a zero-day, as in zero days of notice for the vendor to be able to patch the hole). It’s unclear from what we know so far whether Google Chrome’s sandbox protects you from this exploit, or if they found a way to get through it. Either way, it’s non-stop security holes in browser plugins that present one of the very biggest security risks right now — and much of this malware will take over and completely hijack your computer with ransomware, which encrypts all of your files and prevents you from using your PC until you pay them (or completely wipe the machine, losing all your data). If you want to protect yourself from this and the other 5,382 new security holes that will probably happen in the next few months, here are your options: Best Option: Disable Plugins, Enable Click-To-Play, Install Malwarebytes Anti-Exploit 
The safest option is to just disable plugins entirely in your browser. If you have a particular website that you visit that needs Flash, either create a new browser profile or use a separate browser just for that site. Enable Click-To-Play for plugins, and then install Malwarebytes Anti-Exploit — which is completely free for the basic version. On my computer, I use Safari as my main browser, and I have all plugins disabled. When I want to watch Netflix, I use Google Chrome with all plugins except Flash disabled, and plugins are set to Click-To-Play mode so they won’t activate automatically. If you’re a Chrome user you could install Firefox and use that as your Netflix browser, or even Internet Explorer if you choose. I’m using a MacBook, so there’s no Anti-Exploit tool for me to use. Next Best: Enable Click-To-Play, Install Malwarebytes Anti-Exploit 
If have too many sites that you visit that require Flash, enable Click-To-Play for plugins in every web browser. It’s a little bit of a pain, but it’s much better than having your computer hijacked by ransomware that encrypts all of your files and prevents you from accessing anything. Once you’ve done that, install the free Malwarebytes Anti-Exploit on your PC to help protect you from these types of things. You’ll also want to be careful what you click on, but that is something that everybody that has had a computer has heard at some point, and people still end up clicking on things, and still end up getting themselves infected. Because the scammers and malware creators are really good at tricking people into clicking things they shouldn’t.
You might notice that we didn’t mention using anti-virus, and there’s a good reason for that. Anti-virus is still important, but it won’t protect you from zero-day attacks, and it won’t protect you when you actually download and run something bad. It’s time to stop thinking about anti-virus as the answer to all your security problems — it’s just one piece of a security solution.
Previous Thoughts You Might Have Missed: | 
Tidak ada komentar:
Posting Komentar