By Renaming Flash Professional, Adobe Does Little To Alleviate Security Concerns

In giving Flash Professional CC a new name this week, Adobe only appears to have prompted fresh questions on when exactly the company plans on phasing out the notoriously buggy technology entirely, instead of just trying to distance itself from it.

Adobe on Monday announced that Animate CC would be the new name for Flash Professional CC.  Animate will become available early next year and will serve as Adobe’s primary animation tool for developing HTML5 content, the company said. The company will also release a video player based on HTML5 for desktop browsers to complement its support for the technology on mobile browsers.

Adobe described the rebranding as part of a broader effort by the company to move to new standards like HTML5 for running animations, multimedia, and video in web browsers. Standards like HTML5 have matured to a point where they provide many of the capabilities that Flash does and customers have said they would like Adobe to adopt such standards, the company noted.

According to Adobe, the rebranding is necessary because they have completely rewritten Flash Professional over the past several years and the product now integrates native HTML5 and support for WebGL. Over one-third of the content created in Flash Professional already is based on HTML5 rather than the Flash format and the name change reflects that evolution, the company said.

Looking ahead, Adobe wants content creators to build apps using the new standards, while the company will focus on supplying tools and services around them. At the same time though, Adobe’s commitment to the creation of new Flash content will continue. “Moving forward, Adobe is committed to working with industry partners, as we have with Microsoft and Google, to help ensure the ongoing compatibility and security of Flash content,” the company said.

Facebook, which earlier this year famously called on Adobe to announce an end-of-life date for Flash, has agreed to work with the Adobe instead. According to Adobe, the two companies will work together to ensure that Flash gaming applications run securely on Facebook. “As part of this cooperation, Facebook will report security information that helps Adobe improve the Flash Player,” Adobe said.

Adobe’s decision to give Flash Professional a new name may well be an attempt to distance itself from a technology that has the unenviable reputation of being among the most vulnerable ever. But it has done little to assuage growing concerns over the security threats posed to users by Flash technology.

“A buggy app is still a buggy app by any other name,” says Richard Stiennon, chief research analyst at IT-Harvest.

Over 50 of 317 yet-to-be-published security advisories involving vulnerabilities discovered by researchers at Tipping Point’s Zero-Day Initiative involve Adobe.

And that’s just the tip of the iceberg. A report released this week by Flexera Software shows that Microsoft ended up as the vendor with the most vulnerable products over the last three months largely because many of the products came bundled with buggy versions of Adobe Flash. Another recent report by Recorded Future showed that eight of the top 10 vulnerabilities used by exploit kit makers in 2015 were in Adobe Flash Player.

The sheer number of recently discovered bugs in Adobe Flash Player and its popularity among exploit kit makers and APT groups such as Pawn Storm raise questions about Flash’s role in a secure environment, Recorded Future had noted.

In that context, it’s possible to see why Adobe may have chosen to rebrand the product, says Scott Donnelly, director of presales at Recorded Future. “It’s a smart branding move for Adobe, due to the heavy associations Recorded Future sees between exploit kits and Flash,” he says. 

“However, based on multiple sources from the web, the product’s security posture remains unchanged for the millions of people who use Flash on a daily basis,” Donnelly says.

So far at least, Adobe has said nothing to indicate that Animate CC will be a major security upgrade over Flash Professional, says John Pescatore, director of emerging security trends at the SANS Institute. “They do seem to be trying to encourage HTML5 output, which is a good thing, but rather than see more features I would have preferred first hearing about a gigantic and deep security push,” Pescatore says.

Users should try to move away from Flash where possible, he says. “Personally, I think the cold turkey approach would be the best way to go. I think users would get over the lack of Flash within a week, if not faster,” he says.

But neither Pescatore nor Stiennon expect to see Flash go away anytime soon.

“Flash is going to be around at least as long as Windows XP,” Stiennon says. “There are too may legacy sites that continue to use it.”