I was under the impression that Adobe Flash was dead, and that browsers were no longer natively supporting Flash? Why therefore, is there a large amount of hype online about a new remote code execution vulnerability in flash?
The short answer is that it takes a loooooong time for software to die. Even in 2018 we still have COBOL running multi-billion dollar companies, despite COBOL being a "dead" language for decades.
The longer answer is there's still a significant amount of websites that require Flash, and people re-enable Flash for practical reasons.
Oftentimes these are "mission critical" internal corporate websites or schools that haven't put a priority on replacing legacy applications based on Flash. This might mean using older browsers where Flash isn't disabled, or just users being trained to re-enabled it every time.
Across the board, the numbers as of April 2018 are around 5% of websites according to https://w3techs.com/technologies/details/cp-flash/all/all
So I wouldn't say Flash is "dead", but it is slowly dying.
Because it's not completely "dead". It's just suppressed, for example, in Chrome the user has to click to allow Flash.
Google has said that by 2020 it will not support Flash at all.
Unfortunately, a lot of corporate software or internal websites still require Flash for various things (and not necessarily a recent version that may have some patches). If a company decides that their internal application requires a five-year-old version of Flash to simply work, they're not going to patch it.
That leaves an awful lot of software and sites that are likely vulnerable to any new attacks based on Flash.
Adobe is still releasing new updates to their Flash editor (now named Animator), and new versions of their Flash player. I think the Flash player updates are less noticeable (working in the background) so we don't notice how often they update now.
They also have their AIR player for mobile phones (the core of Flash is downloaded to a phone once, so apps don't have to include the core, and AIR becomes its own cross-platform marketplace).
It seems like they are trying to migrate many aspects of Flash/Animator to HMTL5/CSS3/JS, I suspect in large part due to waning browser support.
Many browser games were made in Flash, and Adobe still has its Game SDK, which uses Flash for graphical assets.
Several entertainment websites still support and perhaps will continue supporting Flash games despite security concerns, since they are likely to be their largest source of revenue:
- Newgrounds is probably one of the oldest references in the market (1997 Cat Dynamics, oldest content I found) and even though they now support HTML games submissions and their audio content is played through HTML, Flash is still commonly used to submit new content.
- Tencent, the "Chinese multinational investment holding conglomerate" developing WeChat (the most popular social media app in China nowadays), just in 2015 acquired the majority of stakes of Miniclip (Flash games only), despite having their own games website.
- many games websites still heavily rely on Flash for PC, e.g.: R2Games (Chinese), VNG Corporation (Vietnamese), Tacticsoft (Israel), Albino Blacksheep (Canada), FlashArcade (US?)
In order to play most of the games in these websites, the user just needs to:
Which is something that even in most public computers is possible (no installation required since it's embedded in the browser). Usability/quick access trumps security concerns when users are on limited/paid time cybercafés.
I work for a company that is a partnered with a large agricultural company. Said Ag company uses Flash for all their web based applications. Even newly (less than 6 months) released applications. Unfortunately, many companies don't see the negative sides of using a known vulnerable application and will continue to use it as they have invested time and money into it and want to get a return on it.
In Australia, until recently, the tax office (and other government orgs) were best accessed through Internet Explorer 8! Thankfully, they have changed and Chrome/Firefox work just as well but it shows you can't take the knowledge that something is bad as a sign that everyone will dump it.
All in all, it means we have to care about the dodgy applications that are out there as its better to be aware and patched/mitigated than to get bitten.