Even Flash Can Get Viruses

Mechel Conrad writes: "Heise Online(German) writes about a Virus called SWF/LFM-926. It consists of a Macromedia Flash movie and seems to be the first of its kind. It uses Flash's scripting language in order to open a debug terminal creating and executing a file called V.COM, which infests other .SWF Files. Although the virus is not very dangerous and not widespread yet, it suggests clear security holes in Flash." The translation of the Heise article is quite readable, too. Update: 01/08 22:47 GMT by T : bdavenport adds: "this report on Yahoo lists a new Shockwave virus as low grade due to the need of manual downloading. infoworld is reporting that McAfee has upgraded to high risk after several Fortune 500 firms have reported it in the wild, arriving as an email attachment."

Let's Just Pray That We Can't Get Foot & Mouth

[ekrout]

http://www.satirewire.com/news/0103/outlook.shtml [satirewire.com]

Build it, and they will...

[Ethelred Unraed]

...write a virus for it.

Cheers,

Ethelred

Finally!

[kilrogg]

Us Linux users can enjoy a flashy virus for once. We need more cross platform stuff like this.

Re:Cross Platform?

[Anonymous Coward]

You guys come up more than a 1% marketshare, preferrably in corporations with fat checkbooks, and McAffee and Norton will find a way to make the viruses work :)

That vulnerability is purely theoretical...

[chazR]

The still-excellent l0pht [l0pht.com] once informed the world that Microsoft had a serious security problem in a product.MS responded with the famous "That vulnerability is purely theoretical.". So, l0pht released a real exploit for the vulnerability.

Apologies, it's hard to find the original links since l0pht got up in the morning, put on a suit, and became @stake [atstake.com]

Hello. Wake up. Theoretical vulnerabilites become real, nasty, exploited vulnerabilites very fast. I assume you read comp.risks?

Looks like it isn't very likely to succeed

LOOKS LIKE? It's a done deal. Somebody has exploited a widely-distribited scripting engine. The people who did it as a "proof-of-concept" have proven that the interpreter for this language is wide-open and gagging for a jolly good rogering. I wonder how many unchecked buffers there are in that code. I wonder how it handles multi-byte characters. I desperately hope it wasn't written in C.

I sit here as a smug old Unix hacker, secure in the knowledge that lisp and Smalltalk programs are unlikely to be attacked in the same way that C programs are.

I'm also sure I'm wrong.