Should Adobe auto-update Flash and PDF Reader?

This year has seen Adobe plugin exploits hit the headlines. Is it time that the company automatically updates its software?

Adobe Flash symbol

Adobe needs to find a way to make sure that all of the users of its software are updated automatically, according to a leading security researcher.

Mikko Hypponen, chief security researcher for F-Secure, said that users were not typically found vulnerable through their operating systems, but rather through plugins and add-ons found inside internet browsers.

This means software such as Adobe PDF Reader and Flash, Java or Quicktime. While Windows is updated automatically, these are still left unpatched and therefore vulnerable to new exploits.

This is especially dangerous as Adobe Flash has a bigger market share than even Windows, and Mac and Linux users often had it on their systems. Of these users, 80 per cent ran old Flash.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

It is also problematic that users aren't required to click on a Flash or PDF file, as you can get infected by simply browsing a website.

"That's the way that attackers gain way, and if you look at the market share of things like Adobe Flash or the PDF reader plugin, they are huge," said Hyponnen.

"Most of them are not up to date. Microsoft can do this, so Adobe should be able to do this as well."

Security exploits against QuickTime plugins were also an issue, which users often didn't install but found in their systems.

"It's because I have an iPod," Hyponnen said. "And because I have an iPod I have to install iTunes. When I install it will, without asking me, install QuickTime automatically."

QuickTime automatically installs a plugin inside a web browser, which means that if there is a flaw, it could be exploited.

Advertisement - Article continues below

"I'm not concerned with updating QuickTime. I've never even installed it," he added.

Adobe had not responded to request for comment at the time of publication.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/infrastructure/server-storage/354508/synology-flashstation-fs3400-same-old-same-old
Server & storage

Synology FlashStation FS3400: Same old, same old

9 Jan 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/business-strategy/34599/adobe-shuts-down-service-to-venezuela
Business strategy

Adobe shuts down service to Venezuela

9 Oct 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/microsoft-windows/354526/memes-and-viking-funerals-the-internet-reacts-to-the
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020