66

I was under the impression that Adobe Flash was dead, and that browsers were no longer natively supporting Flash? Why therefore, is there a large amount of hype online about a new remote code execution vulnerability in flash?

Improve this question
12
  • 41
    Browsers still support it, they just disable it by default except for whitelisted domains, and allow the user to selectively enable it as needed for other domains.
    – Barmar
    Apr 11, 2018 at 21:32
  • 2
    Some people play every game they can find online, including Flash games like AntBuster and Manufactoria. It's not just Flash games by the way: android apps, android games, games from a bribed company, ...
    – user21820
    Apr 12, 2018 at 6:04
  • 14
    Even when browser publishers will finally completely stop supporting it sometime in the future, and most already disable it by default, there are many (mostly not technically versed) people who for whatever reason disable updates or even just decline whenever the update message opens, and thus stay on years old browser and plugin versions.
    – Raimund Krämer
    Apr 12, 2018 at 6:35
  • 2
    Companies can use HTML 5 to do everything Flash Player can do, but they have to learn different ways of doing things in order to do so. It's cheaper to keep using Flash. It's better and more secure to use HTML 5 techniques, but I'm sure there are some vulnerabilities there, as well.
    – Joshua Nurczyk
    Apr 12, 2018 at 7:50
  • 5
    Why therefore, is there a large amount of hype online - remember that a big part of the hype is various "security experts" trying to promote their "expertise" by writing scary articles about this new vulnerability. And then low grade tech journalists pick up the fake hype to write tons of articles on the subject. In the end you get the impression that its a big issue even if its not a big deal in the first place.
    – JonathanReez
    Apr 13, 2018 at 3:01

6 Answers 6

Reset to default
100

The short answer is that it takes a loooooong time for software to die. Even in 2018 we still have COBOL running multi-billion dollar companies, despite COBOL being a "dead" language for decades.

The longer answer is there's still a significant amount of websites that require Flash, and people re-enable Flash for practical reasons.

Oftentimes these are "mission critical" internal corporate websites or schools that haven't put a priority on replacing legacy applications based on Flash. This might mean using older browsers where Flash isn't disabled, or just users being trained to re-enabled it every time.

Across the board, the numbers as of April 2018 are around 5% of websites according to https://w3techs.com/technologies/details/cp-flash/all/all

So I wouldn't say Flash is "dead", but it is slowly dying.

Improve this answer
20
  • 29
    In Korea, there are still sites that require Flash to function, and many that even require ActiveX to function at all! Imagine the horror, a site built entirely off of something like that, in 2018.
    – forest
    Apr 11, 2018 at 23:06
  • 32
    5% of websites is still an incredibly huge number
    – usr-local-ΕΨΗΕΛΩΝ
    Apr 12, 2018 at 8:25
  • 21
    The death of COBOL is greatly exaggerated. I still see plenty of job posting for COBOL developers.
    – Clearer
    Apr 12, 2018 at 13:16
  • 55
    @Clearer: half of them is just retirement homes searching for new occupants.
    – PlasmaHH
    Apr 12, 2018 at 13:45
  • 14
    Worse than legacy applications are the legacy devices. At my job, we have tens of thousands of dollars invested in hardware devices that can only be managed via built-in web interfaces using Flash, Java or ActiveX components. It's a nightmare.
    – jmbpiano
    Apr 12, 2018 at 16:46
19

Because it's not completely "dead". It's just suppressed, for example, in Chrome the user has to click to allow Flash.

Google has said that by 2020 it will not support Flash at all.

Improve this answer
1
10

Unfortunately, a lot of corporate software or internal websites still require Flash for various things (and not necessarily a recent version that may have some patches). If a company decides that their internal application requires a five-year-old version of Flash to simply work, they're not going to patch it.

That leaves an awful lot of software and sites that are likely vulnerable to any new attacks based on Flash.

Improve this answer
4
  • 2
    Also, there is a lot of long-term-investment hardware (think LOM cards in servers, RAID appliances networking, UPS and telecom equipment...) that relies on java and/or flash in its web interfaces. This stuff is usually packed away in a firewalled mainentance network, and you do usually NOT want to mess with its firmware images (especially if that stuff is infrequently accessed, and ways to work it with are part of emergency documentation). A frequent reason to have very, very violent attitudes about "no user recourse" browser security policies.
    – rackandboneman
    Apr 12, 2018 at 18:49
  • There's nothing quite like seeing Edge's "you've stumbled across some ancient web tech" message on your company intranet homepage.
    – mbrig
    Apr 13, 2018 at 17:40
  • Aren't many of these uses just simple things that are a little too much for Javascript? It's not like they were writing games. .. for example my state's business records division still uses java to show you TIFF files of docs... it's nothing but a bit of glue.
    – Harper - Reinstate Monica
    Apr 14, 2018 at 22:06
  • Flash is still used on webapps like Mint (investment trends) and TeamViewer.
    – Stevoisiak
    Apr 25, 2019 at 18:01
4

Adobe is still releasing new updates to their Flash editor (now named Animator), and new versions of their Flash player. I think the Flash player updates are less noticeable (working in the background) so we don't notice how often they update now.

They also have their AIR player for mobile phones (the core of Flash is downloaded to a phone once, so apps don't have to include the core, and AIR becomes its own cross-platform marketplace).

It seems like they are trying to migrate many aspects of Flash/Animator to HMTL5/CSS3/JS, I suspect in large part due to waning browser support.

Many browser games were made in Flash, and Adobe still has its Game SDK, which uses Flash for graphical assets.

Improve this answer
1
  • 2
    Indeed, my small company has been working on converting our Flash-based game to HTML5/JS for the past couple of years. We have most of the major features replicated, but still have a huge number of little things remaining.
    – Barmar
    Apr 11, 2018 at 21:43
3

Several entertainment websites still support and perhaps will continue supporting Flash games despite security concerns, since they are likely to be their largest source of revenue:

In order to play most of the games in these websites, the user just needs to:

Click to Allow Flash

Which is something that even in most public computers is possible (no installation required since it's embedded in the browser). Usability/quick access trumps security concerns when users are on limited/paid time cybercafés.

Improve this answer
1

I work for a company that is a partnered with a large agricultural company. Said Ag company uses Flash for all their web based applications. Even newly (less than 6 months) released applications. Unfortunately, many companies don't see the negative sides of using a known vulnerable application and will continue to use it as they have invested time and money into it and want to get a return on it.

In Australia, until recently, the tax office (and other government orgs) were best accessed through Internet Explorer 8! Thankfully, they have changed and Chrome/Firefox work just as well but it shows you can't take the knowledge that something is bad as a sign that everyone will dump it.

All in all, it means we have to care about the dodgy applications that are out there as its better to be aware and patched/mitigated than to get bitten.

Improve this answer
1
  • Internet Explorer 8? What is this, the Flintstones?
    – Radvylf Programs
    Apr 14, 2018 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .