Top 10 vulnerabilities in 2015 are due to Flash

The annual report of software exploits of 2015 is out and it gives some shocking results. Usually attacks were more focused on Java security flaws but in the past year, exploit kit makers have switched from targeting Java security flaws to exclusively exploiting weaknesses in the Adobe’s Product, a recent report from the NTT group shows.

According to the security firm, all of the top 10 vulnerabilities targeted by exploit kits during 2015 were Flash flaws. According to historical records kept by the NTT Group, 2015 was the first year when exploit kits used more Flash flaws compared to Java, which almost disappeared from exploit kits altogether. This change in trends comes after Java was 2012, 2013, and 2014’s most targeted technology via exploit kit vulnerabilities.

Besides this Adobe product, in 2015, the second and third most targeted technologies were Internet Explorer and Microsoft Windows.

The main reason behind this trend is because of the massive security updates Java received in 2014 which made exploitation much difficult. Hackers turned their focus on Flash, which saw four zero-days in 2015 only from the Hacking Team data breach alone.

A similar report released by Symantec two weeks ago also confirms this trend. Symantec says that Flash vulnerabilities accounted for 17 percent of all zero-days in 2015, with four of the top five most used zero-days in 2015 belonging to Flash.

With so much material to work with and with Java’s extremely hard-to-bypass security features and dwindling market share, it is to no surprise that Flash usage in exploit kits has grown so much. The security upgrades that contributed to Java’s downfall from exploit kit arsenals are the click-to-play feature and Oracle’s decision to block unsigned applets by default.

In order, the top 10 Flash vulnerabilities used in exploit kits last year are as follows: CVE-2015-0311, CVE-2015-5119, CVE-2015-5122, CVE-2015-0359, CVE-2015-0313, CVE-2015-2419, CVE-2015-3090, CVE-2015-3113, CVE-2015-0336, CVE-2015-7645, and CVE-2015-3105.