Slashdot Log In
Flash Vulnerabilities Affect Thousands of Sites
Posted by
kdawson
on Sun Dec 23, 2007 12:26 AM
from the waves-of-shock dept.
from the waves-of-shock dept.
An anonymous reader sends us to The Register for this security news. The problem is compounded by the fact that some of the most popular Web development tools for generating SWF produce files containing the recently disclosed vulnerabilities. "Researchers from Google have documented serious vulnerabilities in Adobe Flash content which leave thousands of websites susceptible to attacks that steal the personal details of visitors. A web search reveals more than 500,000 vulnerable applets on major corporate, government and media sites. Removing the vulnerable content will require combing through website directories for SWF files and then testing them one by one. Updates in the Adobe software that renders SWF files in browsers are also likely, but they probably wouldn't quell the threat completely... No patch in sight from Adobe, that's the price to pay for depending on proprietary solutions."
Related Stories
Submission: Serious Flash vulnerabilities affect many websites by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Proprietary, huh? (Score:5, Informative)
There are open source implementations of the Flash protocol; I'm running Gnash [gnashdev.org] as my SWF player on Ubuntu 64, and it works just fine. Your mileage may vary.
Re: (Score:3, Informative)
Re:Proprietary, huh? (Score:5, Insightful)
In summary, "Phishing can work against Flash apps." Specifically, the article says someone at Google documented something about XSS working against Flash apps...being really light on the details. This could apply to Google's stock market Flex charting, for example. Adobe hasn't done anything about it and didnt respond to EMAIL inquiries about it.
My question is who asked The Register, to troll against Adobe? AND how did it get posted on
Parent
Re: (Score:3, Insightful)
Firefox + NoScript FTW. Filters XSS even from sites you've otherwise whitelisted (which does *very* rarely cause a problem, but you can manually override if necessary.)
Flash danger (Score:5, Informative)
Say I want to read your email. I send you an email with a Flash animation in it. You read it and your webmail verifies there's no dangerous scripts in my email - but it's much harder to verify my Flash I sent you is safe. Which I'm counting on because I've put code in that creates a script tag in the webpage, downloads my dangerous script, and sends me your cookies. Now I can read your email.
Flash has been getting a free pass on security for a long time. Time for things to tighten up on the web viewer more widely installed than Internet Explorer.
Parent
Re: (Score:3, Informative)
I've never seen one which does this, for that very reason, as this study seems to prove:
http://www.campaignmonitor.com/blog/archives/2006/01/the_truth_about_1.html [campaignmonitor.com]
This issue isn't really the fault of Flash, but more web applications not validating their input and allowing the user to insert HTML tags where they shouldn't.
Re: (Score:3, Informative)
I tried Gnash, and it didn't work on the flash pages I tried it on. Although there are open-source development tools for flash, such as mtasc and haxe, there are a lot of obstacles, both legal and technological, that anyone will encounter if they try to do OSS development on the flash platform. If you want to generate AS3, the only OSS compiler is hax
Re:Proprietary, huh? (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
The problem is that it lacks a little more work to be always stable and some more to get other codecs like speex incorporated. But the developper is gone and nothing has been developped since 2006. So it could be a nice project to pick up for someone with knowledge in Java, who want to do some usefull work for the Free Software users instead of only relying on Free alternative to the Flash player wich wo
Re: (Score:3, Insightful)
The guy even calls Flash a "protocol"! This is the OPPOSITE of insight!!!
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Who thinks anyone will be working on this grave security issue during the holidays ?
If it was an open source project, I think it would be more likely a (or few) developer(s)
would be.
I could be wrong ofcourse.
What do you think ?
Block Flash wherever possible (Score:5, Informative)
On Firefox, there's an extension called Flashblock [mozilla.org]. It blocks Flash by default, but allows you to re-enable it on a page-wide or applet-by-applet basis. Several other extensions will do the same thing.
In IE7, you can double-click a spot in the status bar (third box, right to left, of the boxes just to the left of the security zone indicator (the thing that usually says Internet)) or open the Add-on Manager from Tools in the command bar or menu bar, and disable or enable the Flash ActiveX control. This will globally enable or disable flash, but doesn't take effect on a given page until that page is refreshed. Alternatively, the third-party add-on IE7Pro has applet-by-applet flash blocking.
I realize that some sites need it, and on those there's nothing you can do about this problem except hope Adobe updates their software ASAP. For everywhere else though, do yourself a favor and block it.
Re: (Score:3, Informative)
whitelist sites via right-click, edit site preferences
Even Lynx had problems, so.... (Score:4, Informative)
http://secunia.com/advisories/17372/ [secunia.com]
http://secunia.com/advisories/17216/ [secunia.com]
That is with just a text-only browser.
So, should we go back to using
echo -e "GET / HTTP/1.1\nHost: slashdot.org\n\n" | netcat slashdot.org 80
Kinda sucks!
Clearly one of the answers is to limit the browser to sub-user access. I think that is what Vista tells us is happening there. Debian doesn't do that by default. But then I'm not sure how easy it would be to limit iceweasel (firefox) to not executable stuff except known plugins, etc...
As for the solution to problems like this, it is clearly the client that needs patching!! A client needs to handle ALL cases without allowing someone to compromise information, etc.
There is a balance between security and usability. You can't have both perfect at the same time.
Parent
Re: (Score:3, Funny)
echo -e "GET / HTTP/1.1\nHost: slashdot.org\n\n" | netcat slashdot.org 80
Kinda sucks!
Eff that. Gopher's still going strong!
Re: (Score:3, Informative)
Flashblock unfortunately loads the Flash file still as the page is loading momentarily before it 'blocks' it.
It would be nice if Firefox implemented Konqueror's feature of clicking a box to use the plugin. Unfortunately that stuff also breaks flash detection pages (which is why I suspect flashblock permits a s
Permanent workaround (Score:5, Insightful)
So you don't want to use YouTube then? (Score:3)
Is slashdot evil? (Score:4, Funny)
Why was the book released before the patch? (Score:2)
Re:Why was the book released before the patch? (Score:5, Informative)
A more formal vulnerability report is being co-ordinated with CERT and should be out soon with the details of the issues.
Parent
Can someone explain how this is supposed to work? (Score:2)
What about flash videos? (Score:2)
Article is vague on the details... (Score:3, Insightful)
Huh? So this is some kind of phishing attack? Exactly how is Flash involved, and what should we be watching out for? (Other than never entering important data into a form we reached by clicking... always good practice.)
Just more X-Site scripting = Relax a little (Score:5, Informative)
Although this can "help" an attacker steal information the end user still has to click a link provided by the attacker that tricks the user into thinking they are on someone elses site and seeing content that site generated.
Cross site scripting attacks are not to laughed off, but they do tend to get over exagerated. When is the last time you clicked on an email link sent to you out of the blue...and then stuck in your user name and password.
People could just as easily fall for attacks like this that don't even change the URL. Not to mention that this has to upload the payload to a server. Meaning you can steal people's information, but it has to go to an IP somewhere. Maybe if law enforcement would get off their behinds and go after this f'ers it wouldn't be such a big issue.
All the anti-flash posts need to get down voted. I could easily say that Jscript sucks because of all the various security issues it has had over the years, but it isn't useful or productive. Flash is what flash is...you don't like it...don't install it and shutup and let the rest of us use it.
Flash: The Best Among Bads? (Score:3, Insightful)
On the other hand, looking at what Flash does, and at other technologies that do these things, it seems to me that Flash is clearly technologically superior. I don't know how large the browser plugin is these days, but the one that used to come with Opera used to be very small, and yet provide features that web masters are trying to kludge together with AJAX and whatnot, and for which the W3C has come up with the gargantuan SVG, which has even more elephantine implementations. Flash is the clear winner here.
And then, of course, there is the misuse of Flash for things where Plain Old HTML would be much better. But then again, if Flash were a widely-implemented open standard (rather than a widely-implemented proprietary technology which yet leaves some users in the cold), perhaps such use wouldn't be _mis_use.
So, all in all, I think that Flash would be _great_ if it weren't proprietary...but the fact that it _is_ proprietary is a real obstacle.
Flash != Evil (Score:5, Insightful)
In the past, many vulnerabilities have been reported on the Flash player, but most of them follow a similar kind of theme - the rogue SWF file must be created with third party authoring tools, and or modified in a hex editor, in order to put the malicious code in there to begin with. In addition, due to the security sandbox and crossdomain restrictions, it needs to be downloaded from your site anyway. So, its perfectly possible for a SWF to wreak havoc on a user's machine, the only caveat is that someone within a company, with access to the web servers and source code, would need to have created it in the first place - something I'm sure is indicative of a larger problem!
Oddly, most non Flash/web developers tend not to see it that way - I have a beautiful MP3 of a conversation I had with one of our 'Security' people who just consistently ranted on about undisclosed vulnerabilities as a reason not to use Flash in a project.
In my years of working with the web and the Flash platform, I have not yet seen a single workable exploit that could present a credible threat to the majority of Flash user's on the web, not without the user or the site already being compromised in some manner.
The only somewhat grey area is where Flash is used for online advertising, but you will find that most of the main publishers out there are aware of this and perform some level of code review on ads before they go live - I work for a bank and we don't run any 3rd party adverts without seeing the sourcecode and decompiling any SWF assets provided.
Really guys, the Flash platform isn't the cloud of evil you are making it out to be. Granted, it has been used for some really annoying things in the past, but used right, it can really help to deliver a friendly, usable and engaging user experience. In addition, in Adobe's hands we have seen it become more open than ever before - Flex, AMF, Tamarin, all released as open source in the past year. I'd be surprised if this trend does not continue.
You guys are 99% wonky (Score:3, Informative)
In my opinion, every web technology sucks pretty mightily, for one reason or another. They are either abused by malevolent advertisers or 13 year olds, not supported uniformly by all platforms or browsers, and are a pain in the ass to design with. Dynamic HTML is a bad joke. Javascript invented pop-up hell. And praise CSS all you like, it's a strategy only a programmer could love. You can't center things reliably with it no matter how many hoops you jump through. That's something even HTML 1.0 could manage.
My own clients LOVE Flash sites. They insist on them. They want animations, and sound, and websites that look the same in every browser. (Flash's ability to proportionately scale content to the window is a thing of beauty, and one of the most underused talents of the plug-in. Why some Flash designers insist on manipulating the window size instead is beyond me) The only people who don't love Flash sites are other programmers. And I'm more than happy to take their business.
Hating Flash for bad Flash sites is like hating scientists for making gunpowder possible. Live in a teepee or run a casino...your choice.
Re: (Score:3, Insightful)
HTML doesn't have the expressive power to be dangerous. Go ahead and make a bad site with HTML and be as malicious as possible: you still can't do anything really dangerous. At worst, you might exploit a browser bug; but that will be a problem with the browser, not the format and the intended expressive power of HTML. Flash, in stark contrast, now allows the author to resize browser wi [youtube.com]
Re:Preference (Score:5, Insightful)
Parent
Re:Preference (Score:5, Insightful)
Parent
To hell with Flash anyway... (Score:3, Interesting)
Useful or pertinent information (if it is manifest at all) usually has the appearance of being inserted as an afterthought. That's why the sites I visit most often tend to be based primarily on simple markup such as HTML, which despite its various drawbacks is at least easy to maintain (and therefore more likely to be maintained), and does not have the noli-me-tangere character of a cast-bronze SWF presentation.
I
Re: (Score:3, Insightful)
Re: (Score:2)
What file format do you use for videos?
Re:Preference (Score:5, Insightful)
Parent
Re:Preference (Score:5, Interesting)
Parent
Re:Preference (Score:4, Funny)
You must be new here... this debate isn't about whether or not the suggested alternatives to Flash are supported or practicable.
It's more to do with people having look at reality and coming to the conclusion that they just don't like or believe certain aspects of it.
Call it a selective disregard for the facts or utter stupidity if you will, but its kinda groovy...
I think that the audio and video functionality of Flash/Flex can and will be replaced by chaz haskins' svg wondershow plugin.
See it's easy! get into it.
Parent
Neither is Flash (Score:3, Insightful)
Neither is Flash.
Both needs a plugins to work.
The HUGE difference comes from the fact that Flash is only available from 1 single company which produce plugins for only a small handful of platform (except maybe for the open-source Gnash [gnashdev.org] plugin, which already kind of works, but still needs a lot of efforts).
Whereas, MPEG player are available for whatever platform you may think about as long as it has either the processors horsepower or a decoding co-p
Re:Preference (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Many sites use flash for no good reason when pure HTML would be perfectly fine.
In the process they make the entire process less secure, more error prone and
ultimately less accessable.
flash vs. flash for no good reason.
Re:I'm no fan of proprietary solutions, but... (Score:4, Insightful)
Parent
The price comes in.. (Score:5, Interesting)
The community might ignore such a patch, and it might not even happen that often, but if things were generally dire enough in a projects mainstream, a new leadership could fork the project and that is not unheard of in projects. Of course, it's common for distributions to apply security updates to their packages before upstream merges them, so it isn't *that* strange.
Not related to security, but the current version of the flash plugin, for example, breaks compatibility with linux opera and konqueror due to Xembed, and packagers hands are kind of tied in terms of what to do about it. Of course, can also point out the ATI drivers, which suffer greatly from problems and are dealt with in a way that doesn't work.
Parent
Re: (Score:3, Interesting)
Now let's say that Gnash works approximately like Flash does; do you your design in a 'source' file called a
Funnily enough.. (Score:3, Insightful)
As to the question at hand, I don't know enough detail about the vulnerability myself, however note:
Stamos said Adobe is likely to update its Flash Player so it does a better job of vetting code variables before executing SWF files. But he said interaction with third-party code is such a core part of the way Flash works that updates to the player would likely provide only a partial fix.
So while I do not understand the technical details, those that do understand believe some sort of player-side sanity checks would be good to mitigate the consequences. In the open-source world, they would be able to co
Re: (Score:2, Informative)
Re:A lot of the vulnerable Flash is THIRD PARTY (Score:4, Interesting)
Or am I missing something?
Parent
Re: (Score:2)
Flash: PASS: (the blink tag was never good) (Score:3, Insightful)
Nice rant, but you seem to fail to realize that the web, and computer software in general, tend to fall in the same sort of categories. That's just the way it is. Don't forget Sturgeon's Revelation, "90 percent of everything is crud." (Though I believe this estimate to be conservative, and certainly the adjective chosen is much more polite than is usually quoted.)
I'd rather have the possibility of having those few brilliant F
Re: (Score:3, Informative)