Tag Info

Hot answers tagged

13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


10

It's not called Flash Drive By, but Drive-By Download, and yes, it's basically downloading malware just by visiting an infected website. Usually drive-by downloads work by exploiting a browser vulnerability (or a vulnerability in plugin like Flash or Adobe Reader), which leads to remote code execution triggering the download of malware. Unfortunately ...


9

No virus is possible if the browser has no bug. No escalation to admin rights is possible if the OS has no bugs. Unfortunately, bugs happen... in both the OS and the browser. Vulnerabilities which allow a non-admin process to gain admin rights (e.g. this one) are rather common, and it is usually assumed that getting through the browser is the complex part, ...


9

Fundamentally you cannot secure your client. At best you can obscure and obfuscate in order to make it more difficult for an attacker to modify the client. You mention that it is not a security issue because the server is properly secured, but merely an annoyance. It may be more annoying to try to obscure your client than to let a few modified clients make ...


7

SWFScan for any Nemo 440 for AS3, Flex, AIR Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft Also see osflash.org and flashsec.org


7

Targeting sandboxed platforms like Flash and Java will be excessively difficult if you're just starting out, so I suggest you learn to walk before you try to run. Some stuff you'll want to know: How to code in a low level language like C. What the stack, registers, heap, etc. do, and what happens when you overflow them in various ways. At least basic x86 ...


7

None. If they don't decompile your app, they will just put it through a proxy with it's own SSL certificate. Your client can't provide security for your backend.


7

Adobe Flash is 21 years old (started as FutureWave's SmartSketch), over the years it had to be able to deal with many different OS's, standards, and all the quirky restrictions they brought along with them. Most of the work done on Flash is aimed at keeping it up-to-date with the latest technologies, adding more and more features over time. This doesn't ...


6

A parameter is a parameter: a data element (necessarily a character string, in the context of a URL) indexed by a formal name. What is done with that parameter on the server is entirely up to the server. We here enter the realm of suppositions. The parameter name "xmlPath" is suggestive of the parameter value being a path name for a file which uses XML. We ...


6

Older versions of flash .swf's contain vulnerabiltiies. A user could upload a clip created with an older version of Flash CS and thus expose hundreds of end users. If they don't have the latest flash player (and many don't), they could catch a nasty bug. The .swf could be triggered to launch a cross-site injection that deploys an IFRAME within the user's ...


5

Check out Fuzzing with DOM Level 2 and 3 "Overview Fuzzing techniques proved to be very effective in finding vulnerabilities in web browsers. Over time several valuable fuzzers have been written and some of them (mangleme, cross_fuzz) have became a "de-facto" standard, being widely adopted by the security research community. The most common ...


5

Original source -- http://my.safaribooksonline.com/book/networking/security/9780596806309/inside-out-attacks-the-attacker-is-the-insider/content_ownership 2.4.1. Abusing Flash’s crossdomain.xml The same origin policy can often be deemed too restrictive, causing application developers to clamor for the ability for two different domains to work interactively ...


5

Flash has been a high-value target for exploit developers for years, particularly because of its near-ubiquitous installation base and the fact that (historically) it will generally run automatically whenever a page with Flash content is loaded. This makes it very easy for a large number of systems to be targeted and compromised with a single exploit. As it ...


4

You are right. There are really many ways for a website to store persistent data on you, even if you dont want them too. Evercookie by Samy Kamkar is an example of this. Quotede from the site of Evercookie it stores persistent data on you with the help of these storage mechanisms: Standard HTTP Cookies Local Shared Objects (Flash Cookies) ...


4

Actually, depending on the browser and plugins used, there are many ways for a website to store persistent information on users' computer. It's not cookies and cache anymore. Some of these new methods require user confirmation, some don't - it also varies by browser. Flash has Local Shared Objects, Silverlight has Isolated Storage, HTML5 itself gives Offline ...


4

No - the DOM does not expose access to the SSL certificate for the current page, all you get access to is location.protocol which allows you to check if you are being delivered over HTTPS


4

You can try SWF Decompiler to convert SWF to FLA for getting any information that might you wouldn't get from FLA Movies for penetration testing http://www.sothink.com/product/flashdecompiler/


4

Another good tool that I have used successfully in the past is OWASP's SWF Intruder.


4

Everything here depends on the version of your Flash Player. Here's a list of stuff, which you should try on this .swf file. Our first guess was Cross Site Scripting so we should try our hand at XSS, especially that we noticed one of the unsafe method: loadMovie. Cross Site Scripting There are a few types of unsafe functions. Each of them has different ...


4

While the "watching a screen" aspect of that site is pure flash, the screen sharing component is not. When you attempt to share your screen, it downloads an executable to install; an .exe on Windows, and a .pkg on Mac. So, yes - it's a foreign binary with the capability to steal all of the data you mentioned and more; but the sharing isn't using flash, so ...


4

The risks of Flash are client side. When viewing an compromised site that is well designed (not susceptible to XSS), there should be no difference in security between Flash and HTML 5 since the content is not malware. The main security problem with flash is for the client. When they visit a site infected with Flash based malware, bad things can happen to ...


3

The answer is: yes. You should always worry about software. "Complexity is the worst enemy of secuirty" --Bruce Schnieir That being said, if your machine is fully patched one of the many flash 0-days will still compromise the machine. XSS is exploitable regardless if your machine patched. This flaw is usually exploited with JavaScript ...


3

Flash is jailed by the some-origin policy and can only act upon a site that loads the flash applet with scripting access enabled. However, flash can become a vector for XSS. The demo above lists various XSS vectors. So for example in the extremely unlikely condition where you are loading a flash applet where the attacker can control the loadMovieNumVar ...


3

You asked about alternatives. Quite frankly, this is a tough one: if someone is playing man-in-the-middle on your SSL session, and the user hasn't noticed or has allowed it to proceed, you're in a really tough spot. However, I'll try to brainstorm some alternatives that you could consider, if Javascript isn't able to check the cert the server provided on ...


3

While "flash cookies" might be easy to clear as cx42net noted above, there are also other techniques that can be used to store hard-to-delete cookie-like data and read it from the server side. Take a look at evercookie for reference. I've seen this used in relatively high profile e-commerce and content sites.


3

Since 6u10 Java applets have been able to store "muffins" (effectively cookies) using java.jnlp.PersistenceService. Also from the same release, Java applets can also open files through FileOpenService, FileSaveService and ExtendedService.


3

Silverlight can actually access the local filesystem, depending on the permissions granted. It is subject to .NET security mechanisms, but if these are badly configured, it is possible to read a user's files, or even change them.


3

Security advantages on the server side, or client side? For serverside (hacking the server - getting access to the server files) I don't see any advantages to do either one or the other. They are both files that do nothing. If you use PHP or another serverside language, that may cause problems, but then it's PHP, not Flash or HTML5. On the client side, ...


3

In the Web browser context, there are two kinds of SSL connections: the ones that the browser manages, and the ones that your code (be it Java, Javascript...) manages itself. For the first kind, you are mostly out of luck, because the browser will not give you details about the server certificate chain. The browser tells you "this is all dandy" but gives ...



Only top voted, non community-wiki answers of a minimum length are eligible