Risks associated with the Adobe Flash animation file format and its use on the web, as well as Flash player applications. For flash drives, use the tag flash-memory.

learn more… | top users | synonyms

0
votes
2answers
539 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
1
vote
1answer
128 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
0
votes
1answer
53 views

Secure crossdomain for rtmp/flash streaming/wowza

I've been a bit lost. I have the following situation: Flash Player file is on https://sub.example.com/player.swf crossdomain.xml is on https://sub2.example.com/crossdomain.xml Streaming is done ...
3
votes
0answers
40 views

Is filtering flash based on the mimetype enough to keep it out?

As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
1
vote
0answers
59 views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
0
votes
0answers
7 views

What are the security implications of external call by moviecliploader.loadclip(externalUrl)

I want to use a piece of Actionscript in this fashion var loader = new moviecliploader(); loader.loadclip("http://" + imageLocation, imageHolder); The web application firewall will keep out any jar:...
0
votes
0answers
111 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way ...