1

Are Flash (.swf components on webpages) a security threat?

  1. Flash banners (without any user interaction, not asking for any permission... just like static .swf add-slideshow)?

  2. Flash apps, that require simple user action, asking e.g. to use the Microphone. (i dont care of privacy, but ability to hack whole system in case of clicking YES)

  3. Flash apps, that are complete/heavy web-applications, like a web-based "image editor" or etc.

Also see this similar question about Java.

closed as too broad by D.W., grochmal, S.L. Barth, crovers, Xander Jan 5 '17 at 22:51

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

There are no formal differences between the different kinds of Flash apps you describe. That division is rather artificial. I would say that they are all the same thing - Flash apps.

And yes, Flash apps can be dangerous. If there is a vulnerability in your version of Flash (and there has been loads of those) a malicious app can fool Flash to run arbitrary code. That means that they can do anything they want on your system, such as installing malware. In fact, this is one of the most common methods to spread drive by downloads.

Also, off course, if you give the app any special permissions, like using the microphone, it can use that permission in ways that might not benefit you without even exploiting any vulnerabilities. If you let it use the microphone, obviously it can record everything you say and send it off somewhere. Maybe not great for privacy.

That is why the following is good advice:

  • Unless you really need Flash for something (and nowadays, a lot of people don't) just uninstall it and the problem is gone.
  • If you don't want to uninstall it, make sure to do the following:
    • Set it to block by default so no Flash apps run unless you let them.
    • Only run Flash on sites you trust not to do anything malicious (and not to be hacked someone who spreads malware).
    • Keep Flash updated.
1
  1. If 'banners' means simply asking for user permission before executing the plugin, then the answer is yes - on an unpatched vulnerable system. Eg - CVE-2015-5122

  2. Yes. Why not? I can record with your mic, take pictures of you and upload it for blackmail value or use it in a bunch of other nasty ways. Even if you don't care about someone being able to record you or photograph you, think about the possibilities of using this in combination with a flash 0day or even a vulnerability left unpatched by you, the user.

  3. If you consider (1) and (2) security flaws, then this is a possible attack vector. Just apply the same exploitation concepts here. There's no difference.

Java exploitation: As @Anders said, this answer has been moved to that link

tl;dr: Yes. All of these are possible attack vectors, either in combination with SE or through exploitation of unpatched systems or using private exploits.

1

Yes, just like JavaScript can introduce a DOM based XSS vulnerability into the page due to improper encoding of user data, so can Flash.

e.g. Just the existence of a vulnerable Flash file on the server can introduce reflected XSS:

https://example.com/zeroclipboard.swf?id=\"))}catch(e){alert(1);}//&width=500&height=500

This is due to a vulnerability in Flash ExternalInterface.call(). Adobe do not consider this a bug due to the fact that they say parameters passed should not be attacker controlled, however I would say it is because certain inputs are not handled correctly. To mitigate this, proper encoding and validation should be enforced in all Flash code deployed.

Not the answer you're looking for? Browse other questions tagged or ask your own question.