The Year in Flash
summary
Five Adobe Flash vulnerabilities (three nearly identical) surface in the hacking team dump, followed by dozens of fixes: 33 in July, 23 in September, 20 in October and 36 in June, and an emergency patch that fixes a class-overwrite zero day. Exploits move from cheap reuse of vectors to harder chains after vector mitigations and an isolated heap split; over 79 MCU use‑after‑free bugs get fixed. Attackers respond with complex, multi-stage exploits and researchers expand testing (including fuzzed JPEGs).
AI-written summary · about
chapters (20)
- 0:00Start
- 4:14Flash is...
- 10:07CVE 2015 3039
- 12:49Vector Mitigation
- 16:48August 2016
- 17:00CVE-2015-5550 (MovieClip Uars)
- 19:36September October 2015
- 20:23CVE-2015-7545
- 22:17How was this bug exploited
- 22:34November and December 2015
- 26:05February 2016
- 26:53CVE 2016-0985
- 27:42CVE-2016-0985
- 31:22CVE 2016-0998
- 34:31CVE-2016-1019
- 36:10June 2016
- 37:26Conclusions
- 38:51The Future What's left
- 39:01The Future (What's left?)
- 40:09Questions?
related talks
01h 05mFinding and Fixing Security Bugs in Flash
17mNew Tool For Discovering Flash player 0-Day Attacks in the Wild from Various Channels
39mA landscape of unintended consequences
35m0-day In-the-Wild Exploitation in 2022...so far.
53mFive Years of 'Make 0Day Hard'
28mEpidemiology of Software Vulnerabilities: A Study of Attack Surface Spread
53mVulnerabilities Are Ingredients And OWASP Top 10 The Seasoning- Meghan Jacquot
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits