Sign in / up

back to article Google researcher calls for Flash flush

A Google researcher is advising that security professionals rewrite code associated with Adobe Flash content two weeks after warning that buggy files can be exploited by attackers to gain complete control over transactions on websites belonging to banks, government agencies and other trusted organizations. The security bug …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. Sandra Greer
    Coat

    Flush all the Flash

    It's all lipstick on a pig anyway. It warms me heart that there are vulns associated with it. Google should skip any page that includes the sticky stuff.

    Red windcheater, long black scarf, bye!

    0 0
  2. TeeCee Gold badge
    Happy

    Well f*** me!

    Something not written by Microsoft has a really nasty security hole in it.

    What is the world coming to?

    It's a good thing for Adobe that MS don't do "look 'n feel" lawsuits like the nibbled fruit lads :-)

    0 0
  3. Pascal Monett Silver badge

    Can't stand Flash

    I do not criticize the format itself, some good things have been done with it. What I do criticize is the tendency that much too many sites have to manage everything in a single Flash applet.

    Useless, annoying, bandwidth-killing and destroyer of HTML links.

    Whenever I stumble across a site that is Flash only, I quickly go away and hopefully never return.

    0 0
  4. Ferry Boat

    Fumble fluff

    Thanks be for Firefox and good old Flashblock. I never see that stuff.

    0 0
  5. Jez Caudle
    Stop

    Scan code doesn't work if host name has 1 in it.

    Make sure your local hostname doesn't have a 1 in it or the thing won't work - use 127.0.0.1 instead if running locally or create something in your local hosts file.

    The hostname for my server had two 1's in it and all I got was JS errors!!

    0 0
  6. Rune Moberg
    Thumb Down

    Still don't understand the vulnerability

    I just don't get it. Who inserts code where? What exactly will I have to do to expose myself to danger?

    Is the trick that flash content on web site A can access flash content on web site B if both sites are open in the same browser? (as an entry point to the entire B website)

    Or: How do you get to the point where you can inject script code into the flash hosted by the targetted website? Can you do it from JavaScript?

    I'm not asking for a recipe, these are mostly yes/no questions. The article is verbose where it really doesn't need to... Yet leaves out the important bit: Telling me exactly what I have to avoid.

    --

    Rune

    0 0
  7. Anonymous Coward
    Anonymous Coward

    Let me see if I can explain

    I think you avoid flash fullstop. :)

    It seems to work this way:

    Site bankinc.compromised has a flash applet on the site which is vulnerable.

    You visit the bank and start a logged in session, which is controlled by a cookie only bankinc.compromised can access.

    You get bored and go off to evil.comdom which whilst displaying a number of interesting pictures is also trying to load flash objects in the background from various sites with an ill crafted skinName paramater in them. This will allow

    code to be injected and hence control the flash applet running on your browser which comes from bankinc.compromise.

    They get lucky and the code they inject requests all the cookies on the bank site you are still logged in to the bank. And the bank cookies are now available via the compromised flash. The code also communicates those cookies back to evil.condom thru your browser.

    Once evil.condom operator has your cookie, they could hijack your bank session.

    It is a cross site attack and they could do more beyond just taking the cookies, but the cookies are the obvious one, and you would hope they checked the IP did not change mid session. Theoretically if the flash was on the make payments page they could automate a payment with it.

    Who inserts code where? bad guy calls flash from bank using a skinName param which allow arbitrary to code to run in the bank's flash.

    What exactly will I have to do to expose myself to danger? Allow flash to run and use a trusted site that has flash anywhere on the domain.

    Is the trick ... ? No - bad site calls the bank flash - like you embed a site in a site, or snaffle an image.

    Where is the injection, is javascript to blame? No, javascript is not to blame the flash html object is if you must blame something - but really it is flash.

    0 0
  8. Anonymous Coward
    Coat

    @Rune Moberg

    >> Yet leaves out the important bit: Telling me exactly what I have to avoid.

    Werl... Too much sun, alcohol, cigarettes, fried food, drinking tap water in developing countries mostly. And obviously, anything that looks like a land war in Asia !

    Coat already on.

    0 0
  9. Anonymous Coward
    Alert

    @Rune Moberg

    I searched my Mac & XP for *any* files related to Flash and Shockwave, deleted them, ages ago! What I avoid is having time/bandwidth wasting blipverts , which incidentally can do cross site scripting. I have the usual sacrificial PC/Mac filled with every multi-media add-on to keep the kids happy at youthTube or whatever todays social networking site is called. The work Mac/PC will remain locked down. (no sign of 2o7.net cookies!)

    0 0
  10. unitron

    Bugs IN the file?

    Aren't the Flash files themselves the bugs?

    0 0
  11. Rob McCleave
    Flame

    Stop using flash.

    There are sites like CNET.com that are so full of Flash based ads that the page is impossible to read. They have full motion videos with sound that load automatically, and if you want to scroll anywhere you have to manually turn them off first.

    These guys wouldn't dream of having imbedded MIDI files playing tunes and animated GIF files everywhere, like some Geocities template page about cute kittens from deepest cyburbia.

    They do it with Flash and that's somehow more sophisticated.

    I use Firefox and Flashblock and don't visit CNET very often.

    0 0
This topic is closed for new posts.

Other stories you might like