The easy Java and Flash security fix everyone hates to do
Over the past five quarters, the portion of U.S. Java users with unpatched versions of the program on their systems increased to 50 percent at the end of 2014, up from 44 percent in Fall, 2013, according to data from vulnerability management firm Secunia. A similar, if slightly muted trend, affects U.S. users of Adobe Flash: The portion of users with older versions of the program reached 24 percent at the end of 2015, slightly up from five quarters earlier.
Programs like Java and Flash, which run on many different operating systems are "gifts to hackers," said Kasper Lindgaard, director of research and security for Secunia.
"They run on all different kinds of operating systems, so if there is a vulnerability, the attackers can use it on every target," he said.
No wonder, then, that the creators and users of key cybercriminal tools, known as exploit kits, regularly focus on both Java and Flash. While the number of attacks from exploit kits has declined since the 2013 arrest of the group suspected of being behind the popular Blackhole exploit kit, a number of other popular kits have popped up, and almost every one has included exploits for Adobe's Flash, Oracle's Java or both.
An update to the popular Styx exploit kit late last year included the ability to compromise systems through exploits for any of three Java flaws. While all the vulnerabilities had been patched by Oracle, cybercriminals know that users tend to be slow to patch. Another popular exploit kit, FlashPack, contains code capable of compromising systems using four different Adobe Flash vulnerabilities, two Java flaws, or three different bugs in Internet Explorer.
In 2013, Java was the most popular target of attackers, but in 2014, the number of attacks attempting to exploit the software declined by a third, according to Cisco's 2015 Annual Security Report. A survey of exploit kits by security software firm Trend Micro has found that flaws in Adobe Flash are the most popular vulnerabilities for attackers to target.
It is unclear why users have not patched. Both Oracle and Adobe have focused on security. Installing the latest version of Java should uninstall older, vulnerable versions of the program. Adobe regularly releases software updates. Both companies have added automatic update capabilities to their programs and have set the default setting to regularly check for and install updates.
Adobe recommends that all users update to the latest version of the software. Peleus Uhley, lead security strategist at Adobe, noted that the company has seen a drop-off in successful attacks.
"The majority of attacks we see are exploiting software not up-to-date on the latest security updates, therefore we strongly recommend that users install the latest security updates and enable the background updater as the best possible defense against those with malicious intent," Uhley said.
Other companies' data supports the strategy. Cisco found that consumers and companies that enable automatic updates are less vulnerable.
"The research clearly indicates that software that automatically installs its own updates seems to have an advantage in creating a safer security framework," Cisco stated in its 2015 Annual Security Report.