If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash.

What could a website do to you if the "plugin is vulnerable"?

  • 7
    Given the general quality of Flash security and the level of access that it has on your computer, pretty much whatever it wants. – AstroDan Apr 22 '16 at 16:21
  • Dun, duh, dah, dun.... Anything. Depends on what the Exploit Server sends you. From just barely annoying adware to a full system lockdown by ransomware. – Fiasco Labs Apr 23 '16 at 16:25
up vote 3 down vote accepted

There are several vulnerabilities known in previous versions of Flash which allow to execute arbitrary program code. That means an exploitive website can do anything a program can do which doesn't require administrator privileges, and there are ways to get around that prompt ("privilege escalation").

Among the common exploits which websites like to install through flash vulnerabilities are:

  • botnet trojans which turn your computer into a spam and DDOS relay.
  • browser hijackers which redirect your web searches and inject additional advertisement into websites you visit.
  • keyloggers which spy your usernames and passwords for any social media websites you use, take over your accounts and send spam to your contacts in your name.
  • banking trojans which monitor your online banking activities and try to redirect any payments you make.
  • ransomware which encrypts all your personal files and then demands payment to decrypt them.

So seriously, keep flash updated, or you are easy prey for criminals.

You might also consider setting flash applets to "click to play" in your browser settings (firefox|chrome). That way a website at least needs to trick you into believing it has some content you are interested in to infect you and can't just do it simply by you visiting it.

The real base question here is

What can a malicious website do if it gains access to a run an application on your computer?

Which further boils down to

What can a malicious application do on your computer

Which is pretty much whatever it wants within it's level of access. If it can elevate it's level of access even further it's no longer your computer anymore. It's their's.

  • Giving some tangible examples such as ransomware infection could give readers a better idea of how serious the issue can be. – Silverfox Apr 23 '16 at 11:53

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.