Security Risk with Adobe Flash

[Alfa5F86]

Hello, 

What would be the security risk if devices still have flash on them? 

Thanks, 

[Test Screen Name]

Unfixed security weaknesses could be exploited, to gain access to the devices, steal files and identity, install keyloggers, get the info to impersonate you with the bank and empty your account; your machine could be used to run spam, attack military sites, or host illegal pornography. The usual stuff, this is nothing specific to Flash.

[Alfa5F86]

you mean there is zero security risk for flash? That doesn't make any sense. Can you plz be specific?

Thanks.

[jeromiec83223024 · Accepted solution]

I'm not sure how you got to that interpretation based on the previous response, but you're correct in your understanding that it doesn't make any sense.

Like your browser and operating system, Flash Player is tasked with processing inherently untrusted content.  Attackers and researchers will continue to innovate on the offensive security front, and because Adobe Flash Player is EOL, no future updates are coming from the defense side of the equation. 

Eventually, the bad guys will find and deploy exploits that target machines with old Flash Player versions installed.  Enterprises can license a maintained copy of Flash Player from our support partner HARMAN, in order to run legacy Flash-dependent applications on a maintained version that gets functional and security fixes.  For consumers, we strongly recommend that they uninstall Flash Player at this point. 

For your convenience, here are links to the Flash Player uninstallers: 

Uninstall Flash Player - Windows:
https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html

Uninstall Flash Player - Mac:
https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-mac-os.html

For more background, here's the original EOL announcement from 2017: 

https://theblog.adobe.com/adobe-flash-update/

Here's the consumer FAQ: 

https://www.adobe.com/products/flashplayer/end-of-life.html

Here's the enterprise FAQ: 

https://www.adobe.com/products/flashplayer/enterprise-end-of-life.html

[Test Screen Name]

By "nothing specific to Flash", I mean that this is the sort of thing that security weaknesses lead to. (And I forgot to mention ransomware). I don't mean Flash couldn't be the cause. Any software is vulnerable; and if it is no longer supported, the vulnerabilities make a long lasting target. Surely the bad guys are preparing for a big attack on those who feel that running Flash Player is more important than their security... If you are feeling relaxed about all those things, sure, keep running Flash Player.