Apple Enforces Adobe Flash Player Security Upgrade with Updated Malware Definitions

Discussion in 'Mac Blog Discussion' started by MacRumors, Feb 5, 2014.

  1. macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    Following Adobe's release of a "critical" update for Flash Player yesterday to address a security issue that is currently being exploited in the wild, Apple has updated its "Xprotect" anti-malware system to disable older versions of the plug-in. The move forces users to upgrade to the latest version of Flash if they wish to continue using the still-common media plug-in.

    [​IMG]
    Updated Xprotect definitions requiring new 12.0.0.44 version of Flash Player
    Apple's Xprotect for OS X was introduced as part of OS X Snow Leopard in 2009 as a rudimentary anti-malware system that allowed Apple to block installation and running of the relatively rare cases of known malware targeting Mac systems. By 2011, Apple had upgraded the system to allow users' Macs to automatically check for updated definitions every 24 hours, ensuring up-to-date protection.

    While primarily targeted specifically at malware protection, the Xprotect system also allows Apple to enforce minimum versions of plug-ins such as Flash and Java, and the company has on occasion blocked older versions of both of these plug-ins to ensure that users upgrade their systems.

    Apple's use of the Xprotect system has, however, declined in recent months, perhaps signaling a slowdown in malware and other security issues affecting Mac systems. The most recent significant update to Xprotect definitions prior to yesterday came in mid-September to address the OSX/Leverage.A malware.

    Article Link: Apple Enforces Adobe Flash Player Security Upgrade with Updated Malware Definitions
     
  2. macrumors 65816

    musika

    Joined:
    Sep 2, 2010
    Location:
    New York
    #2
    I haven't had Flash installed on a Mac since 2011. I'm better off without it.
     
  3. macrumors 6502a

    Joined:
    Nov 18, 2012
    #3
    Before anyone starts going on about how Orwellian Xprotect is and that they have a God-given right to run flawed Adobe plug-ins, this ONLY AFFECTS SAFARI. So you are 'free' to download any other browser and run vulnerable software if keeping your pants down is your thing.
     
  4. macrumors 68020

    iapplelove

    Joined:
    Nov 22, 2011
    Location:
    East Coast USA
    #4
    I don't use it much anymore so yesterday instead of updating I uninstalled.
     
  5. macrumors 65816

    furi0usbee

    Joined:
    Jul 11, 2008
    #5
    How do you watch YouTube? If I don't install Flash, I can't watch YouTube using HTML5. So I simply use Click2Flash and then watch HTML5, then load flash as I need it.

    As I recall, when I removed Flash, even with AdBlock on, I got more clutter on websites, where flash ads were.

    So if you can tell me how to solve my issues above, I'll remove Flash too.
     
  6. macrumors 68000

    Tankmaze

    Joined:
    Mar 7, 2012
    #6
    I always use chrome when flash is needed, otherwise I just use safari.
    and I never install flash plugin since chrome launched.
     
  7. macrumors 68020

    guzhogi

    Joined:
    Aug 31, 2003
    Location:
    Wherever my feet take me…
    #7
    I work in a school and a number of teachers watch YouTube, Discovery Education, and other sites that use Flash. It's a real pain to make lesson plans and then see the Flash error thing. While the IT department does have ways to push out the updates, it usually takes a while.

    The problem with Chrome is it's still 32-bit which means no Java. Plus, the grade book software the district uses uses Java so we need to run Safari or Firefox. Plus, for some reason, XProtect prevents Firefox from using outdated versions of Flash & Java for us.
     
  8. macrumors newbie

    Joined:
    Jan 22, 2009
    #8
    My xprotect file hasn't been updated since October ... how exactly does the update process work?

    ➜ Resources pwd
    /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources
    ➜ Resources ll XProtect.meta.plist
    -rw-r--r-- 1 root wheel 1148 Oct 23 20:00 XProtect.meta.plist
     
  9. macrumors 6502

    Joined:
    Feb 9, 2012
    #9
    I wrote a script that disables the minimum version requirements in Xprotect on student laptops when a users logs out and back in. Security is not a real worry on shared student laptops for us. Our staff laptops do not have this script, and we simply ask staff to update Flash (and Java) when Apple updates Xprotect. This seems to work very well for us.
     
  10. macrumors 68030

    Amazing Iceman

    Joined:
    Nov 8, 2008
    Location:
    Florida, U.S.A.
    #10
    Remove the second in command after Flash: JAVA :D
     
  11. macrumors 68000

    Joined:
    Mar 6, 2008
    #11
    Yeah, unfortunately Adobe Flash is still widely used on major websites like YouTube, and while they have an HTML5 version it's terrible, because the vast majority of the videos don't work & I find any videos that have ads running will not run.
     
  12. macrumors regular

    Joined:
    Jun 6, 2013
    #12
    Flash needs to go. It's holding us back: HTML 5 is the future.
     
  13. macrumors 68020

    guzhogi

    Joined:
    Aug 31, 2003
    Location:
    Wherever my feet take me…
    #13
    I think the IT department has the same kind of script, but for all computers. The teachers are given admin rights on their computers, but so many of them don't have the technical know-how to install the updates, and even more of them just don't have the time. Fortunately, we have some software update software by Casper or something so updates can get pushed out, regardless of teacher know-how/time. It just takes a while.
     
  14. macrumors 6502

    FakeWozniak

    Joined:
    Nov 8, 2007
    #14
    I am running the extensions YouTube5 and AdBlock and couldn't be happier. If a website needs flash, I pull out a super old laptop with Win2K to see it. I haven't had to pull out that laptop in years.
     
  15. macrumors 68020

    smithrh

    Joined:
    Feb 28, 2009
    #15
    I have yet to find a single video on YouTube that was missing an HTML5 version.

    Period.

    Quality is just as good.

    Not sure what to tell you, check your extensions, reset Safari, but I've not watched a Flash-based video on YouTube for a very long time now.
     
  16. macrumors 68020

    kazmac

    Joined:
    Mar 24, 2010
    Location:
    ...in my imagination
    #16
    Same here...

    I did this too. I can live without Adobe software.
     
  17. macrumors 6502

    JoeRito

    Joined:
    Apr 12, 2012
    Location:
    New England, USA
    #17
    Agreed... For me since early 2012
     
  18. macrumors 68020

    smithrh

    Joined:
    Feb 28, 2009
    #18
    Let me touch that up a bit:

    Flash is the past, HTML5 is now.

    Note, there are parts of HTML5 video that I can do without - YouTube's DASH implementation comes to mind. Frequently, painfully enough.

    H.265 is likely the future, same quality for half the bandwidth.
     
  19. macrumors regular

    Msail30bay

    Joined:
    Jan 4, 2014
    Location:
    Penn., USA
    #19
    Can you tell me what else (player) to use in Safari? Most of sites uses Flash, example - the NY Times videos. :confused:
     
  20. Moderator

    Nermal

    Staff Member

    Joined:
    Dec 7, 2002
    Location:
    Whakatane, New Zealand
    #20
    Interesting; I just did a fresh install of 10.9.1 yesterday and haven't yet installed Flash... and couldn't find a single video that would play (whether or not I toggled this).

    Edit: Wait, this "featured" one works, but as an example this one tells me that I need Flash. Do both work for you?
     
  21. macrumors 68020

    smithrh

    Joined:
    Feb 28, 2009
    #21
    I'd hardly say most sites use Flash.

    I do find that when sites *only* use Flash (like the NYTimes mentioned above), they're far more interested in serving you video ads which you have to suffer through before you actually get to content.

    TV stations and TV networks are the worst for this.

    Basically, if they try to ram an ad down my throat, I'm simply not going to watch anything from them.

    I've yet to feel that I've missed something actually important.

    The NYT wants to force a 30 second ad on me before a 60 second recap of what they put in print and on-line in words.

    Yeah, no.
     
  22. macrumors member

    Joined:
    Apr 16, 2001
    #22
    I ran into 1 last night: http://www.youtube.com/watch?v=z6kgvhG3AkI . Today, it works without flash. I guess the age of the video may have something to do with it. It was only like 2 hours old when I watched it.
     
  23. macrumors 68020

    smithrh

    Joined:
    Feb 28, 2009
    #23
    Both work for me in HTML5/mp4.

    I've found that Flash needs be *installed* before the plugins that allow HTML5 will work.

    Give that a try. Yeah it's a PITB...
     
  24. macrumors 601

    petvas

    Joined:
    Jul 20, 2006
    Location:
    Mannheim, Germany
    #24
    I have Flash installed on my iMac and while I don't really like it, it is a necessary evil. Many websites do use it, and I don't want to use Chrome just for these sites. I use Safari all the time, and I utilize Safari's new plug in energy saver function to control which sites are allowed to run Flash. It works very well and there is no need for click2flash.
    Of course, if using a laptop Flash has a much bigger impact on energy requirements than on an iMac. This is one of the advantages of not having to worry about power saving features I guess.:)

    I agree that Flash needs to go, but there is still a lot of content out there that needs to be converted to something better. HTML 5 is a good alternative for most things, but it seems this is not necessarily the future. I guess we will see a newer HTML version coming at some point...
    Read here for more information: http://www.andrewgreig.com/257/
     
  25. macrumors 68020

    smithrh

    Joined:
    Feb 28, 2009
    #25
    It will depend on what format the video was originally submitted in as well.

    YouTube makes several versions of each video, at varying resolutions. It's not an instantaneous process, so while I've never run into an issue with a format being unavailable, I'm sure it happens once in a blue moon to folks.
     

Share This Page