Assuming an attacker does not have access to your LAN\Router etc... How could they take control of your web cam\system peripherals\other resources via a flash vulnerability. That's what I hear on the news, and I would like to be made familiar of the methods used.

I can possibly see it happening if the webserver\web master wants to attack you, as he would have your ip address and other identifying information and I guess go from there. But how would an attacker that doesn't have access to the webserver launch a lateral attack on the user's of that site? And how are flash's vulnerabilities leveraged?

BONUS:Finally, bonus question, for pentesting I hear that we have to use a sniffer like nmap to scan for vulnerabilities on particular ports\services on a host on a network. I guess those vulns are previously discovered and written down on some database on the web. But my question is: once we have a target computer, how do tools like metasploit work? does the attacking computer create a particular packet that we know the target computer will handle in a self-defeating manner?

I am new to all this, so excuse my ignorance.

  • links in emails to malicious sites, ad networks, etc. There are lots of ways to get someone to your malicious Flash – schroeder Oct 20 '15 at 0:36
  • How does that work with big sites like yahoo? How does a hacker attack users of yahoo? What you are saying is you have to run malicious flash content on your devices\links i understand that as i said a webmaster could attack the users. but how would users attack other users in the example of yahoo? I guess the attacker would have to compromise yahoos webserver, but beyond that not sure – Johnnie Oct 20 '15 at 0:41
  • As I say: ad networks. – schroeder Oct 20 '15 at 0:45
  • by the way: your bonus question is actually a separate question - can you pull it into its own question? But before you do, you want to look at "exploits" - these are how you take advantage of vulnerabilities and each exploit works in their own unique way, some are network-based, some are local – schroeder Oct 20 '15 at 0:47

It is (in my opinion) possible to spread Flash Mal easily through every possible source:

  • Obscure Social Media/Sharing Sites
  • Email Scams
  • Advertising Networks
  • Hacked websites riddled with hidden flash content

For example 18 Hours Ago (from this post) Adobe fixed a vulnerability (CVE-2015-7645)

There was a reason Steve Jobs never wanted Flash on iOS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.