If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash.
What could a website do to you if the "plugin is vulnerable"?
-
7Given the general quality of Flash security and the level of access that it has on your computer, pretty much whatever it wants. – AstroDan Apr 22 '16 at 16:21
-
Dun, duh, dah, dun.... Anything. Depends on what the Exploit Server sends you. From just barely annoying adware to a full system lockdown by ransomware. – Fiasco Labs Apr 23 '16 at 16:25
There are several vulnerabilities known in previous versions of Flash which allow to execute arbitrary program code. That means an exploitive website can do anything a program can do which doesn't require administrator privileges, and there are ways to get around that prompt ("privilege escalation").
Among the common exploits which websites like to install through flash vulnerabilities are:
- botnet trojans which turn your computer into a spam and DDOS relay.
- browser hijackers which redirect your web searches and inject additional advertisement into websites you visit.
- keyloggers which spy your usernames and passwords for any social media websites you use, take over your accounts and send spam to your contacts in your name.
- banking trojans which monitor your online banking activities and try to redirect any payments you make.
- ransomware which encrypts all your personal files and then demands payment to decrypt them.
So seriously, keep flash updated, or you are easy prey for criminals.
You might also consider setting flash applets to "click to play" in your browser settings (firefox|chrome). That way a website at least needs to trick you into believing it has some content you are interested in to infect you and can't just do it simply by you visiting it.
-
"You might also consider installing a browser extension like NoScript which disables any flash content until you enable it manually by clicking on it.". - You don't need an extension for this, browsers have this built-in: support.mozilla.org/en-US/kb/set-adobe-flash-click-play-firefox / support.google.com/chrome/answer/142064 – Rob W Apr 23 '16 at 12:28
-
The real base question here is
What can a malicious website do if it gains access to a run an application on your computer?
Which further boils down to
What can a malicious application do on your computer
Which is pretty much whatever it wants within it's level of access. If it can elevate it's level of access even further it's no longer your computer anymore. It's their's.
-
Giving some tangible examples such as ransomware infection could give readers a better idea of how serious the issue can be. – Silverfox Apr 23 '16 at 11:53
