Slashdot Log In
HP's Free Adobe Flash Vulnerability Scanner
Posted by
kdawson
on Tue Mar 24, 2009 02:10 PM
from the practicing-safe-flash dept.
from the practicing-safe-flash dept.
Catalyst writes "SWFScan is a free Flash security tool (download here), released by HP Software, which decompiles all versions of Flash and scans them for over 60 security vulnerabilities. The scan detects things like XSS, SQL inside of the Flash app, hard-coded authentication credentials, weak encryption, insecure function calls, cross-domain privilege escalation, and violations of Adobe's security recommendations. There is also this video explaining a real, and amusing, attack against a Flash app. These issues are fairly widespread, with over 35% of SWF applications violating Adobe security advice."
Related Stories
Submission: HP Releases Free Flash Vulnerability Scanner by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
SFWScan (Score:5, Funny)
Can they also make SFWScan?
That would help avoid potentially embarrassing situations at work.
Re: (Score:3, Funny)
Sure, here's some code to do that:
if (strcmp(link.postedby, "Anonymous Coward") == 0 || strstr(link.url, "goatse" != NULL) return false;
else return true;
Re: (Score:2)
HP, is that you?
Re: (Score:2)
Sure, here's some code to do that:
if (strcmp(link.postedby, "Anonymous Coward") == 0 || strstr(link.url, "goatse") != NULL) return false;
else return true;
Fixed that for you ;)
Re: (Score:2)
Wow, I failed it big time :( *goes off into corner to cry to himself*
Wonder when they will release ... (Score:2)
Re:Wonder when they will release ... (Score:5, Insightful)
Paranoid much? This is for Flash developers to avoid doing stupid things with an app that endangers their site, perhaps with a few checks to help avoid exposing their customers to additional risk. Why on Earth do you think there is an ulterior motive here?
Keep in mind there are already loads of .NET security analyzers out there. TFA notes that the current Flash analyzers are frequently not up to date with the latest Flash releases. Is it so horrible of them to try and be helpful?
Parent
Re: (Score:2, Insightful)
It's safe to assume that no one actually uses Silverlight so this would be a moot point.
Re: (Score:1)
if ((`fdisk -l | grep FAT32`) || (`fdisk -l | grep NTFS`)) then; echo "Your system is infected!"
Re: (Score:2)
If/when they do I will agree HP's intentions are bona fide.
What evil, ulterior motive could there be for HP to write a tool so that Flash developers don't expose themselves or their users to security risks?
Thanks for the setup... (Score:2)
"I can haz cheezeburger? For LIFE?"
Re: (Score:2)
Flash needs some accountability (Score:1)
What good is it? (Score:5, Interesting)
Re: (Score:2)
Seeing as how all these flash apps rain down upon us from the mysterious heavens, and the processes that create them are far beyond our understanding, not much.
Re:What good is it? (Score:4, Insightful)
Parent
Re: (Score:2)
I believe the idea is to check for Flash apps that are dangerous to the server, not the client. For example, you don't want to have the admin password to your database stored as a string inside your flash app.
Does it also neuter the writer when it finds something like this? Those people should not reproduce.
Re: (Score:2)
Thankfully I don't have to bother with this kind of stuff. Antivirus 360 says that everything's A-OK on my system. I sure paid a lot of money for it but I don't have any problems with stuff like this!
Re:What good is it? (Score:4, Funny)
And the guy in the video has a plate of burgers to prove they did it anyway.
Parent
Re: (Score:2)
I've always wondered why people don't realize that a "life without walls" is also a life without security and privacy... (Good fences make good neighbors.)
I understand what the MS market-droids were shooting for here, but that assumes there are only benevolent forces at work in the world. MS is not one of them, in my opinion.
Re: (Score:3, Insightful)
Unless they make it into a Firefox plug-in that checks the flash code before running it, just what good is this?
For starters, it might allow someone to make a Firefox plugin based on it.
Export Source (Score:1)
Em, don't know too much about laws and stuff, but doesn't anyone at HP see the potential copyright troubles with transforming flash bytecode to source?
Re: (Score:2)
In order to obtain the binary file, you have to make a copy of it (during the process of downloading it to your computer). If you're legally authorized to make that copy, you're authorized to make more copies. You're not authorized to distribute these copies without explicit permission, but HP isn't talking about doing that.
Where do you see a potential copyright issue?
Re: (Score:2)
> If you're legally authorized to make that copy, you're authorized to make more copies.
That does not follow at all.
> Where do you see a potential copyright issue?
In practice there is none but not for the reason you give.
Re: (Score:2)
> If you're legally authorized to make that copy, you're authorized to make more copies.
That does not follow at all.
What authorizes you to make the first copy?
Re: (Score:2)
The decompiler (Score:2)
I am thinking about learning just a little flash to see "what it's all about" and I (partially due to being lazy) would really like to see if the output of this program is useful in any way.
Re: (Score:3, Informative)
He didn't make it very clear in the video, but a decompiler doesn't really give you the original source code to the program. It gives you source code that works the same way and, when compiled, would result in the same binary. However, comments are not included, and it's possible that variable and function names might not be preserved (depending on the language and how the program was compiled). Also, the compiler might have performed various optimizations, and upon decompiling you'd get the source code
Re: (Score:3, Informative)
While all of your comments about decompiling are true, the output of this particular decompiler is quite good. Var names remain intact, logical constructs appear valid, etc. I'm no Flash dev, but this looks like the it could be the same code before compilation.
It makes sense if you consider that Flash is an Adobe proprietary "platform" and they can make the compiler and interpreter in any way they please. I really don't know what's involved in the compilation process, but my guess is that it's no where n
Re: (Score:2, Informative)
It would have been nice (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Nothing personal, but....
what the heck did you think it would be for? Seriously.
Although realistically, it shouldn't be a particularly complex program, I wouldn't think, so it should probably work under Wine.
Seriously? (Score:2)
I have XP in a VM, but considering how little I use it, and what for, I am just plain not interested in a Windows version of the program. Too much of a pain in the butt.
This is the tool Prajakta Jagdale spoke about.. (Score:4, Informative)
"Blinded by Flash: Widespread Security Risks Flash Developers Don't See"
From the presentations description:
"In this presentation I will examine the Flash framework and then delve into the Flash security model and the transitions it has undergone over the years. To explore the avenues of compromise in the security model, I will use a test Flash application and demonstrate various attack vectors including Cross-Site Request Forgery, data injection and script injection. During this demonstration, I will explain the associated threats in detail and discuss means to mitigate these threats. Even though the test application validates the attack surface, the question remains: how many applications actually deployed are vulnerable to these threats? I will answer this question by providing astonishing statistics about vulnerable, real world applications I was able to find using simple Google queries."
The pdf of her presentation is here:
https://www.blackhat.com/presentations/bh-dc/Jagdale/BlackHat-DC-09-Jagdale-Blinded-by-Flash.pdf [blackhat.com]
Re: (Score:1)
Interesting. That file is gone and so is Google's cached version. Just how much info was in that PDF?!
Re: (Score:2, Informative)
Re: (Score:1)
Flash security often overlooked (Score:3, Insightful)
Though I haven't had a chance to evaluate it just yet, I think this is a step in the right direction. Flash security is often overlooked, while Flash itself is often overused by designers who think that pretty effects make the web page. It gets especially bad when Flash is used for activities that require some sort of security, such as a login form. 99% of the time, instead of POST'ing that information to a server side script, it's handled inside the SWF file. Since these can be easily decompiled (grab a copy of Flare or any other decompiler), the password is easily revealed. I recently found a network product which went through the trouble of XOR'ing a password and storing in a text file. Two problems: the text file was in the web root, and the XOR key was inside the SWF. Tools like this can only raise awareness of these types of issues.
Youtube (Score:5, Interesting)
And lo: it's got 7 vulnerabilities.
It's interesting how this behemoth of a flash provider is still not secure.
*reaches for tinfoil hat*
Re: (Score:3, Interesting)
Adobe Captivate export fails the tests (Score:1)
Direct Download link. (Score:2, Informative)
https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/images/SwfScan.msi
Clarification (Score:5, Informative)
It sounds like SWFScan actually scans flash SWF files, not flash itself like the post suggests.
HP and Security???? Um, no. (Score:1)
I would never trust HP with anything with the word 'security' in it. I worked in the service department in the largest computer retailer in Australia (Harvey Norman) for 8 years and still work in the industry. HP, for as long as I can remember, have been putting a backdoor trojan called "Backweb" in their computers for years. They now call it "Updates from HP", but it's the same program. Early versions of Spybot S&D (from the 2003 era) removed it as a threat, as did several other spyware scanners.
I had
Decomplier (Score:1)
I love decompliers ... nothing like ripping something apart and finding out what makes it tick!
Gage
www.impostormag.com
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Assuming they have the source code, in the example given, how WERE they supposed to do it? The only thing I can think of is "When they make a query, run a procedure on a database that takes the IP, stores it, and Increments a value ("wins per day")"
Excellent question.
Unfortunately, IP addresses aren't reliable for this purpose. However, in order to win you have to provide your e-mail address, and the coupon is e-mailed to you. The simplest solution would be to store e-mail addresses in the database and (as you suggest) limit the wins per day for each e-mail address. Another idea is to generate a unique ID for each visitor to the site (using cookies), and make sure one user doesn't submit requests with multiple e-mail addresses.
Of course, what's not