Adobe Flash Player is a common browser enhancement that enables so-called "rich web content" - animations, video, in-browser games, interactive advertisements, and more. It's also a top target for malicious hacks - a bogus Flash program that automatically launches when you open a web page can take over your computer. Over the last few weeks, there have been a series of malware outbreaks exploiting vulnerabilities in Flash to infect unsuspecting people's computers.
With Flash installed, all it takes is browsing to a compromised website to become infected yourself. There's no way of knowing in advance if a site is compromised: in fact, a common infection method lately is to insert a malicious Flash file into an advertising network, which may be used by hundreds if not thousands of otherwise benign websites. Visit a normally-safe site whose ad network has been compromised, and your PC can become infected as soon as the page loads.
Adobe (the maker of Flash) has released updates to fix each vulnerability as it comes to light. Depending on your browser, the updates may be installed automatically, or you may need to install them yourself. That still leaves a period of time when bad guys are using a vulnerability that has not yet been fixed - you can't update your software if no update has been developed yet.
A second step you can take that is effective whether or not a fix is out, is to change the default browser settings for Flash content. By default, most if not all browsers automatically display interactive Flash content. You can instead set the browser to ask before displaying Flash content. It is simple to do, it is next to no inconvenience to you, and it stops this sort of automatic infection dead in its tracks. Read on for specific steps in each of the three major PC browsers.
Google Chrome
Google's Chrome browser has Flash Player built in to the browser; Flash Player updates are included with Chrome updates, and are installed automatically. A simple way to verify this is to open Chrome's "plug-ins" window to see the current version of all plug-ins (plug-ins are "helper programs" that hook into the browser to provide additional features). Chrome does not provide a way to get to the plug-ins window through menus, but you can easily find it by typing "chrome://plugins" in the address bar (the same place where you might otherwise enter "https://whatever.com"). As of this writing, version 18.0.0.194 is the latest - but that will change this week as there is yet another newly-discovered unpatched vulnerability being exploited.
If the version shown is older than the latest known version, you can tell Chrome to update immediately instead of waiting for its next scheduled update. Simply click the menu icon (the three horizontal lines at the upper right-hand corner of your browser window), and choose "About Google Chrome." Alternately, you can use the shortcut address "chrome://chrome" to get to this screen. Chrome will automatically check for and install updates when you open the screen.
To change Flash content to "click to play" instead of automatically playing, use another hidden menu option. The shortcut address "chrome://settings/content" opens a content settings menu; look for the section entitled "Plugins," and select "Let me choose when to run plugin content."
With this setting, when you browse to a web page that contains Flash content, instead of automatically playing (or automatically infecting your PC, depending on the developer's intent), you'll see something like this. Only if you click the Flash object will it begin to play:
Mozilla Firefox
For Firefox, the process is very similar, though Firefox provides a visual way to get to the plug-ins menu. From the Firefox start screen, simply click the "Add-ons" icon at the bottom, or type "about:addons" in the address bar:
From the Add-ons Manager, click the "Plugins" tab, and look for "Shockwave Flash." If the version shows as something other than the latest version (18.0.0.194 as of this writing, but that will change as soon as an update is released for the newest newly-discovered unpatched vulnerability), use the link at the top to check to see if your plugins are up to date. From this same screen, you can set Flash content to "Ask to Activate" instead of playing automatically.
Keep in mind that Firefox does not actually update the Flash Player for you. The "Check" link will let you know that a plug-in is outdated and give you a link to Adobe to download an update if needed. The simplest way to actually update the plug-in is through the Flash Player Settings Manager, as shown below.
Microsoft Internet Explorer
Internet Explorer is somewhat less user-friendly when it comes to updating plug-ins. Unlike with Chrome and Firefox, Flash Player settings and updates are not integrated into the browser; instead, Flash Player settings are controlled through a separate Flash Player Settings Manager in the Windows Control Panel. To get there, open the Control Panel (it ordinarily is included in the Start Menu; if you have removed it, simply type "Control Panel" into the "Search programs and files" box in the Start Menu), and select "Flash Player."
Alas Internet Explorer does not have a native "click to play" option. There is a somewhat cumbersome method of forcing IE to prompt you for permission, I am of the mind that if a product is cumbersome, I'll use a different product. For that reason (and others), I disable the Flash Player plug-in in Internet Explorer, and generally do not use IE at all unless a particular website requires it.
Now it's your turn. Do you have any favorite tips for avoiding malicious content hidden in normally-safe websites?
