Adobe Flash attack vector exploits insecure web design
An unpatched security risk involving Adobe Flash creates a possible mechanism for hackers to load exploits onto websites. The vulnerability was discovered by security researchers at Foreground Security and reported to both Adobe and Google, whose Google Applications, including Gmail, are potentially vulnerable to exploit. No …
This topic is closed for new posts.
Deja Vu
"The ideal fix should involve Adobe implementing a more sensible origin policy for Flash objects," Bailey added. However, the downside of making Flash more secure in this way is that it would break legitimate (though arguably badly coded) functionality on many sites.
Hmm, where have I heard this kind of thing before..... Ah yes, Windows.
Thanks for the warning, I'll go and uninstall Flash right now.
Anyone else see the irony
in clicking the link to the Computerworld article only to be presented with a huge Flash ad?
So what???
"However, the downside of making Flash more secure in this way is that it would break legitimate (though arguably badly coded) functionality on many sites."
So break them. Force the coders to re-implement the code the -right- way. Then maybe this crap might stop happening. I'll take security over functionality any day.
The irony
It does make me smile that to illustrate the flash vulnerability, el Reg decided to use... Flash.
For all 5 of us Mac users...
If you haven't downloaded ClickToFlash, do so. http://rentzsch.github.com/clicktoflash/
Flash plugin plays Flash content
I don't quite get why this is Adobe's problem. A web server serves Flash content and the end user's browser uses the Flash plugin to run it. Isn't that how things should work? Shouldn't the solution lie with the website serving the content? After all, if I understand the issue, the problem only affects their site and its users.
More flash vunerabilities?
Wow, <sarcasm> how shocking! </sarcasm>
so how does this actually affect me?
If I entrust data (such as address book , emails etc) to a web service (such as webmail) thenFlash content (within, say, an email) can do what it likes with my data if they are both served from the same domain. Web sites should host unvetted scripted content from a separate domain so its scripts are sandboxed.
Adobe's is putting self-interest before user security in not implementing any mechanism to enforce security. Maybe users should be implementing their won Flash security. I'm with ClickToFLash, and I hope Flash never comes to iPhone.
Easy-peasy, then
Right, let's see. TFA gives us absolutely *no clue* how this works, and I include the "illustrative" YeChoob embed in that assertion (how the frig am I supposed to interpret that?), so let's go to the linked ComputerWorld article:
"He used the example of a company that lets users upload content to a message forum to explain the process. "If the user forum lets people upload an image for their avatar, someone could upload a malicious Flash file that looks like an avatar image," Bailey said. "Anyone who then views that avatar would be vulnerable to attack.""
Point 1: Why the ready, willing and greased-up FUCK would any site let a user upload a Flash file as an avatar in the first place? I do believe most server-side scripting languages can tell the difference.
Point 2: <img src="/usercontent/dodgyflashfile.swf" /> does not render a Flash object in any browser I know of. I can't see why the swf-masquerading-as-gif possibility is an issue here at all. (Correct me if I'm wrong and browsers actually have become that clever/'tarded.)
Any site that (a) lets users upload Flash, Java, JavaScript or *any* damn thing that can make the browser do tricks without *very* thorough vetting by live humans and (b) serves that same content back to *any* user (including the uploader) deserves to be rendered into gobbets by a pitchfork-wielding mob of their users (and I should think the shareholders won't be too far behind).
I struggle to comprehend the fuckwittedness of any web-dev that could allow themselves to be vulnerable to something like this.
you forget about Windows defaults
Windows, and therefore IE, default to execute files based on their content, not on their type (.gif, .pdf, etc). And you're correct, if a website allows me to upload an .EXE file named avatar.gif, then the blame gets spread between the website developers and M$.0
Use Opera
Or use the Opera browser, which has a "ClickToFlash"-type mechanism built into it.
This topic is closed for new posts.
