Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
HP Security

HP's Free Adobe Flash Vulnerability Scanner 82

Posted by kdawson from the practicing-safe-flash dept.
Catalyst writes "SWFScan is a free Flash security tool (download here), released by HP Software, which decompiles all versions of Flash and scans them for over 60 security vulnerabilities. The scan detects things like XSS, SQL inside of the Flash app, hard-coded authentication credentials, weak encryption, insecure function calls, cross-domain privilege escalation, and violations of Adobe's security recommendations. There is also this video explaining a real, and amusing, attack against a Flash app. These issues are fairly widespread, with over 35% of SWF applications violating Adobe security advice."
This discussion has been archived. No new comments can be posted.

HP's Free Adobe Flash Vulnerability Scanner More

HP's Free Adobe Flash Vulnerability Scanner

Comments Filter:

  • SFWScan (Score:5, Funny)

    by MrEricSir ( 398214 ) on Tuesday March 24, 2009 @02:12PM (#27316171) Homepage

    Can they also make SFWScan?

    That would help avoid potentially embarrassing situations at work.

  • ... a vulnerability scanner for Windows Vista, for silverlight. If/when they do I will agree HP's intentions are bona fide.
  • Flash finally has an accountability and score card.

  • What good is it? (Score:5, Interesting)

    by frovingslosh ( 582462 ) on Tuesday March 24, 2009 @02:17PM (#27316243)
    Unless they make it into a Firefox plug-in that checks the flash code before running it, just what good is this?

    • Re: (Score:2)

      by Goaway ( 82658 )

      Seeing as how all these flash apps rain down upon us from the mysterious heavens, and the processes that create them are far beyond our understanding, not much.

    • Re:What good is it? (Score:4, Insightful)

      by ShadowRangerRIT ( 1301549 ) on Tuesday March 24, 2009 @02:22PM (#27316331)
      I believe the idea is to check for Flash apps that are dangerous to the server, not the client. For example, you don't want to have the admin password to your database stored as a string inside your flash app.

      • Re: (Score:2)

        by Jurily ( 900488 )

        I believe the idea is to check for Flash apps that are dangerous to the server, not the client. For example, you don't want to have the admin password to your database stored as a string inside your flash app.

        Does it also neuter the writer when it finds something like this? Those people should not reproduce.

      • Re: (Score:2)

        by Ihmhi ( 1206036 )

        Thankfully I don't have to bother with this kind of stuff. Antivirus 360 says that everything's A-OK on my system. I sure paid a lot of money for it but I don't have any problems with stuff like this!

    • LIFE WITHOUT WALLS - that way you don't need windows.

      I've always wondered why people don't realize that a "life without walls" is also a life without security and privacy... (Good fences make good neighbors.)

      I understand what the MS market-droids were shooting for here, but that assumes there are only benevolent forces at work in the world. MS is not one of them, in my opinion.

    • Re: (Score:3, Insightful)

      by Jurily ( 900488 )

      Unless they make it into a Firefox plug-in that checks the flash code before running it, just what good is this?

      For starters, it might allow someone to make a Firefox plugin based on it.

  • Em, don't know too much about laws and stuff, but doesn't anyone at HP see the potential copyright troubles with transforming flash bytecode to source?

    • Re: (Score:2)

      by Phroggy ( 441 )

      In order to obtain the binary file, you have to make a copy of it (during the process of downloading it to your computer). If you're legally authorized to make that copy, you're authorized to make more copies. You're not authorized to distribute these copies without explicit permission, but HP isn't talking about doing that.

      Where do you see a potential copyright issue?

      • > If you're legally authorized to make that copy, you're authorized to make more copies.

        That does not follow at all.

        > Where do you see a potential copyright issue?

        In practice there is none but not for the reason you give.

        • Re: (Score:2)

          by Phroggy ( 441 )

          > If you're legally authorized to make that copy, you're authorized to make more copies.

          That does not follow at all.

          What authorizes you to make the first copy?

    • Don't know. Don't care. I do know that if it resides on my hard drive, it is _MINE!_ and I'll do with it as I wish. Copyright law was _MEANT_ to prevent other people making money from the originator's work. It was never meant to prevent study, understanding, or, in this case, security work. If present copyright law should be construed to prevent inspection for security work, then OBVIOUSLY the law is in the wrong.
  • Actually I am more curious about the decomipiling process than the actual vulnerability scanner.

    I am thinking about learning just a little flash to see "what it's all about" and I (partially due to being lazy) would really like to see if the output of this program is useful in any way.

    • Re: (Score:3, Informative)

      by Phroggy ( 441 )

      He didn't make it very clear in the video, but a decompiler doesn't really give you the original source code to the program. It gives you source code that works the same way and, when compiled, would result in the same binary. However, comments are not included, and it's possible that variable and function names might not be preserved (depending on the language and how the program was compiled). Also, the compiler might have performed various optimizations, and upon decompiling you'd get the source code

      • Re: (Score:3, Informative)

        by pegr ( 46683 )

        While all of your comments about decompiling are true, the output of this particular decompiler is quite good. Var names remain intact, logical constructs appear valid, etc. I'm no Flash dev, but this looks like the it could be the same code before compilation.

        It makes sense if you consider that Flash is an Adobe proprietary "platform" and they can make the compiler and interpreter in any way they please. I really don't know what's involved in the compilation process, but my guess is that it's no where n

        • Re: (Score:2, Informative)

          by phase_9 ( 909592 )
          It's not the exact same code, but it's pretty damn close - nice to see all my Log.debug(); messages make it through in the decompilation stage...

  • It would have been nice (Score:5, Informative)

    by Jane Q. Public ( 1010737 ) on Tuesday March 24, 2009 @02:36PM (#27316535)
    if the post -- or even the site -- had mentioned that the tool was for Windows only, so that I did not have to register first and then find out.
    • Learn to register properly online. I downloaded my copy after registering as "Some Guy" email "someguy@gmail.net" and clicking the "don't bug me" option regarding email. Geeez. (I wonder if there really IS a someguy@somemail.xxx - he's probably pissed at me for using his address all the time, LMAO)
      • I do that too, but that wasn't my point. My issue is that my time was wasted because I had no way to know that this tool was useless to me ahead of time.

    • Nothing personal, but....

      what the heck did you think it would be for? Seriously.

      Although realistically, it shouldn't be a particularly complex program, I wouldn't think, so it should probably work under Wine.

      • Many tools that are released today are automatically released for Windows, OS X, and Linux. I did not expect them to have a version for each, but considering the number of people today who use an OS other than Windows, it is a rather common courtesy to at least stipulate what OS(s) your program runs under.

        I have XP in a VM, but considering how little I use it, and what for, I am just plain not interested in a Windows version of the program. Too much of a pain in the butt.

  • This is the tool Prajakta Jagdale spoke about.. (Score:4, Informative)

    by Jeff Moss ( 1413027 ) on Tuesday March 24, 2009 @02:43PM (#27316661)
    At Black Hat D.C. last month Prajakta Jagdale spoke about HP developing this tool in her presentation:

    "Blinded by Flash: Widespread Security Risks Flash Developers Don't See"

    From the presentations description:
    "In this presentation I will examine the Flash framework and then delve into the Flash security model and the transitions it has undergone over the years. To explore the avenues of compromise in the security model, I will use a test Flash application and demonstrate various attack vectors including Cross-Site Request Forgery, data injection and script injection. During this demonstration, I will explain the associated threats in detail and discuss means to mitigate these threats. Even though the test application validates the attack surface, the question remains: how many applications actually deployed are vulnerable to these threats? I will answer this question by providing astonishing statistics about vulnerable, real world applications I was able to find using simple Google queries."

    The pdf of her presentation is here:
    https://www.blackhat.com/presentations/bh-dc/Jagdale/BlackHat-DC-09-Jagdale-Blinded-by-Flash.pdf [blackhat.com]

  • Flash security often overlooked (Score:3, Insightful)

    by twistah ( 194990 ) on Tuesday March 24, 2009 @02:47PM (#27316713)

    Though I haven't had a chance to evaluate it just yet, I think this is a step in the right direction. Flash security is often overlooked, while Flash itself is often overused by designers who think that pretty effects make the web page. It gets especially bad when Flash is used for activities that require some sort of security, such as a login form. 99% of the time, instead of POST'ing that information to a server side script, it's handled inside the SWF file. Since these can be easily decompiled (grab a copy of Flare or any other decompiler), the password is easily revealed. I recently found a network product which went through the trouble of XOR'ing a password and storing in a text file. Two problems: the text file was in the web root, and the XOR key was inside the SWF. Tools like this can only raise awareness of these types of issues.

  • Youtube (Score:5, Interesting)

    by JJman ( 916535 ) on Tuesday March 24, 2009 @03:11PM (#27317119)
    So naturally my first thought was, I wonder how well youtube does.
    And lo: it's got 7 vulnerabilities.

    It's interesting how this behemoth of a flash provider is still not secure.
    *reaches for tinfoil hat*

    • Re: (Score:3, Interesting)

      by phase_9 ( 909592 )
      I ran this app on my own Flash App (http://moshimonsters.com/) and it produced a plethora of "Vulnerabilities" - and really dangerous ones too like "Interesting Variable Name" (a variable named "masterList") and "Possible userdata information" (a constant named "LOGGED_IN")... To be honest this seems like a lot of FUD being generated by HP - I mean just go look at the dailyWTF and you'll see programmers butting SQL statements in javascript! Still, I must give credit where it's due and thank HP for providi
  • I tried this on an SWF file created with the Adobe Captivate "publish" feature and it fails pretty badly with lots of vulnerabilities.

  • Direct Download link. (Score:2, Informative)

    by Anonymous Coward

    https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/images/SwfScan.msi

  • Clarification (Score:5, Informative)

    by krappie ( 172561 ) on Tuesday March 24, 2009 @04:32PM (#27319145)

    SWFScan is a free Flash security tool (download here), released by HP Software, which decompiles all versions of Flash and scans them for over 60 security vulnerabilities.

    It sounds like SWFScan actually scans flash SWF files, not flash itself like the post suggests.

  • I would never trust HP with anything with the word 'security' in it. I worked in the service department in the largest computer retailer in Australia (Harvey Norman) for 8 years and still work in the industry. HP, for as long as I can remember, have been putting a backdoor trojan called "Backweb" in their computers for years. They now call it "Updates from HP", but it's the same program. Early versions of Spybot S&D (from the 2003 era) removed it as a threat, as did several other spyware scanners.

    I had

  • I love decompliers ... nothing like ripping something apart and finding out what makes it tick!

    Gage
    www.impostormag.com

  • So *after* the direct link to the video was posted on Slashdot, I was watching the video and the counter tells me that I'm no. 271 to watch this video. Amazing how incredibly serious people are about this kind of stuff. Now I picture the thousands of web developers starting to use the suggested security guidelines..
  • A few years ago I remember seeing a tool called SWFEncrypt, which claimed to do "encryption" on an SWF file. That's an interesting statement to make, seeing as there is no flipping way the Flash Player would be able to play an encrypted movie, but whatever; the company didn't seem to be very forthcoming about much. Anyhow, it basically did some heavy obfuscation on the Flash movie that breaks most SWF decompilers (until the decompiler folks figure out how to work around the obfuscation techniques).

    http [amayeta.com]

Slashdot Top Deals

As you will see, I told them, in no uncertain terms, to see Figure one. -- Dave "First Strike" Pare

Close