Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Risks associated with the Adobe Flash animation file format and its use on the web, as well as Flash player applications. For flash drives, use the tag flash-memory.

-1
votes
1answer
196 views

Secure way to run Flash on Chrome?

I kinda addicted to Little Big Snake, an online game that requires Flash. I'm trying to find a secure way to play this game on Ubuntu using Chrome. I tried Firejail but the game is very laggy with it....
68
votes
6answers
14k views

Why should we care about Adobe Flash?

I was under the impression that Adobe Flash was dead, and that browsers were no longer natively supporting Flash? Why therefore, is there a large amount of hype online about a new remote code ...
2
votes
1answer
199 views

How can javascript files represent a flash-based XSS vulnerability?

I am hosting a static website (no PHP etc., just HTML/JavaScript/CSS) with a security-conscious hoster that proactively removes vulnerable files. This is fine with me. However, their last report ...
1
vote
1answer
186 views

Deliberately vulnerable Flash applications?

I'm trying to find some deliberately vulnerable Flash applications that I can practice security testing on (in the same vein as applications like the Damn Vulnerable applications). Ive noticed there ...
3
votes
1answer
374 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
1
vote
0answers
283 views

How can I decrypt my iphones nand flash memory if I have the pin but phone won't turn on? [closed]

Is there some sort of device I can plug my nand flash chip into and then input my pin and get my old notes and things back?
0
votes
1answer
388 views

Crossdomain.xml - write access to domain

Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy? i.e. Is <cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy> the ...
1
vote
0answers
134 views

Testing Adobe Flash - SWF Stack Corruption

For didactic purposes I have a windows 7 VM with IE11 and Adobe Flash 18.0.0.203. Also, I must test if CVE-2017-2988 can be executed on it. I have downloaded the stackbad.swf, inserted it in an index....
0
votes
0answers
102 views

Recent persistent popups on Chrome trying to get me to download “Flash” [duplicate]

EDIT: I don't think this is 100% a duplicate, so if you've recently (around May 9th 2017) been seeing popups telling you to download Flash, I'd read on before following the link. It appears my Mac ...
0
votes
1answer
130 views

Flash drive returning odd files, and self creating others, any ideas?

I was sanitising a USB drive and after wiping it I ran Recuva to check the results. It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, ...
4
votes
1answer
455 views

CSRF Bypass using ActionScript via weak CrossDomain.xml

I have a target which has weak CrossDomain.xml but it prevents CSRF attack looking at one of the custom HTTP headers. I found following actionscript on a couple of websites, which works perfectly ...
5
votes
1answer
6k views

Why is Google Chrome blocking raw SWF playback?

If you attempt to visit the URL of a raw SWF file, Chrome 57 refuses to display and instead asks if you want to download, with the warning "This type of file can harm your computer". However, if you ...
0
votes
2answers
66 views

Are interactive Flash (SWF) ad banners a security threat?

Many times you have seen banners (Flash ads) on websites, where, when you move your mouse over the banner (without clicking it), you see how an animation in the banner starts moving toward your mouse ...
3
votes
2answers
2k views

Can a website know whether I'm streaming or downloading content?

I'm taking a paid online course in which the videos are streamed through Flash. After much trouble such as quality fluctuations, unexpected changes in playback speed and frozen screens (also ...
1
vote
1answer
55 views

Does the Flash installer use an encrypted download?

A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash ...
1
vote
3answers
150 views

Are Flash .SWF apps (browser) a security threat? [closed]

Are Flash (.swf components on webpages) a security threat? Flash banners (without any user interaction, not asking for any permission... just like static .swf add-slideshow)? Flash apps, that require ...
1
vote
0answers
91 views

Load non-existent flash file through service worker

Using Service Workers it is possible to load non-existent files with the fetch event handler, however this does not seem to work when loading flash files. Is there any way in any browser to do this ...
0
votes
1answer
72 views

Repercussions of disabling file read and write in Adobe Flash player?

There are three settings in mms.cfg that I want to disable. It will disable file download and upload for Adobe Flash, but does it have any deeper issues? LocalFileReadDisable = 1 FileDownloadDisable =...
0
votes
1answer
80 views

Repercussions of disabling sockets in Adobe Flash player? [closed]

I am bit of a newbie to Flash exploits but I have heard that they use sockets to connect to a C&C server. According to the administration guide, I can disable sockets like this: DisableSockets = ...
2
votes
0answers
210 views

Flash Cross-Domain Proof of Concept

In the past, I have been able to successfully test insecure Flash cross-domain policies by using tools such as the followings: https://thehackerblog.com/crossdomain/ https://github.com/nccgroup/...
3
votes
1answer
583 views

How can Flash detect my IP address even when I am behind a proxy?

I'm new to cybersecurity, but I always knew some basic things, or at least I thought so, until I found out that the Flash app may actually get my real IP address even if I'm behind elite proxy. How ...
1
vote
1answer
81 views

Can streaming services, movies, series, be used to infect my computer?

I have been thinking about starting to Watch Movies and series online using streaming (legal). I was wondering if there are any vulnerabilitys in these services which can affect me as a user. I have ...
4
votes
1answer
89 views

Is filtering flash based on the mimetype enough to keep it out?

As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
1
vote
1answer
2k views

How to deal with possibility of viruses on Dropbox, Google Drive, external hard drive, etc?

For home use, what is the best way to deal with viruses that could be on external storage, which seems like a great way for hackers to persist on your system even after a reformat. Maybe the best ...
6
votes
1answer
1k views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
2
votes
1answer
190 views

Is it possible to encode a Flash exploit with msfencode?

I am using a Flash exploit from metasploit, exploit/multi/browser/adobe_flash_hacking_team_uaf. The Cisco FirePOWER services notice these signatures and drop the packets. I was wondering about the ...
1
vote
1answer
810 views

Secure crossdomain for rtmp/flash streaming/wowza

I've been a bit lost. I have the following situation: Flash Player file is on https://sub.example.com/player.swf crossdomain.xml is on https://sub2.example.com/crossdomain.xml Streaming is done ...
2
votes
1answer
451 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required android....
3
votes
1answer
8k views

How to detect, inspect and delete a super cookie of a specific website? [closed]

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
2
votes
2answers
351 views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
2
votes
2answers
144 views

What could a malicious website do if you don't update Adobe Flash?

If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash. What could a website do to you if the "plugin is ...
1
vote
1answer
404 views

Stealing user cookies with flash/actionscript

I know I am asking a dumb question here, but pardon me, I am learning. I found two questions viz, How do I access cookies within Flash? and How to Make a button send an email using AS3 automatically....
0
votes
2answers
70 views

chrome invisible flash document

I have it so flash doesn't start on page load for security and performance. Lately I have been noticing That some pages will load with a flash document that takes up the full screen. I can see it as ...
1
vote
1answer
82 views

FireFox inadvertedly increasing security?

With the known advent of Flash-based cookies and recently something called super-cookies, security and anonymity has become something more of a luxury rather than the norm and merchants want to super-...
19
votes
2answers
1k views

What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015?

It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's ...
2
votes
0answers
1k views

USB Rubber Ducky Firmware Upgrade [closed]

I just erased my firmware, using dfu-programmer-0.7.2: $ dfu-programmer at32uc3b1256 erase Checking memory from 0x2000 to 0x3FFFF... Not blank at 0x2001. Erasing flash... Success Checking memory from ...
-1
votes
2answers
352 views

How do researchers identify vulnerability in closed source software? [closed]

Came across an article, it is about the new BadWinmail vulnerability in Outlook. Being a closed-source software, how do researchers manage to point out that Outlook is not sandboxing the flash? Is ...
1
vote
2answers
992 views

Is HTML5/JavaScript more secure than Flash/Java, as the browser becomes more like an OS? [closed]

I have been asked to post this here: I want to focus on the security of the end-user in these two different scenarios: 1) Pre HTML 5 where the applications and so on lived in plug ins outside the ...
46
votes
3answers
5k views

For an end-user, is HTML5/JavaScript more secure than Flash?

I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
1
vote
1answer
962 views

ClamAV Flagging application .swf files as malware

ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). ...
4
votes
1answer
847 views

Is it possible to log web sites that require Adobe Flash?

We would like to block the use of Flash on our internal network, but believe that several business-critical sites may still rely on that app. I'd love to be able to "watch" the traffic for several ...
1
vote
0answers
280 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way out ...
3
votes
2answers
460 views

Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...
6
votes
1answer
2k views

Should Flash be disabled, or are sandboxes secure enough?

Flash is a hot bed of vulnerabilities. Chrome contains a built in version of Flash, running in sandboxed mode. Obviously, this method is safer than running Flash as a plugin in either Firefox or IE. ...
1
vote
2answers
280 views

How much information a Flash program (Flash app) can gather about computer when running?

Does anyone know if a Flash web application has access to local hard drive? What about OS information or hardware information? If I allow webcam and microphone access, how much information can it get ...
1
vote
1answer
231 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
-2
votes
2answers
812 views

Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...
0
votes
3answers
235 views

My Mom's Flash Player [closed]

So I am slightly more than a dilettante when it comes to security but hardly an expert. I have been reading up on the recent Adobe Flash issues and I wanted to ask a couple of questions: My Mom uses ...
15
votes
2answers
2k views

Why are Adobe Flash exploits found so often? [closed]

Over the last couple of years Adobe Flash published bug fixes for (zero-day) exploits so often, that the installation is already annoying. But why are exploits so often found in this particular ...
2
votes
1answer
144 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...