Questions tagged [flash]

Risks associated with the Adobe Flash animation file format and its use on the web, as well as Flash player applications. For flash drives, use the tag flash-memory.

Filter by
Sorted by
Tagged with
1
vote
3answers
187 views

Are Flash .SWF apps (browser) a security threat? [closed]

Are Flash (.swf components on webpages) a security threat? Flash banners (without any user interaction, not asking for any permission... just like static .swf add-slideshow)? Flash apps, that require ...
1
vote
1answer
83 views

Can streaming services, movies, series, be used to infect my computer?

I have been thinking about starting to Watch Movies and series online using streaming (legal). I was wondering if there are any vulnerabilitys in these services which can affect me as a user. I have ...
1
vote
1answer
83 views

FireFox inadvertedly increasing security?

With the known advent of Flash-based cookies and recently something called super-cookies, security and anonymity has become something more of a luxury rather than the norm and merchants want to super-...
1
vote
2answers
359 views

Buzzfeed just downloaded a binary file to my PC, unasked

The file is binary, named '96748', and it's 12.8kb in size. Ubuntu thinks it's an swf. Thank god I was in a Linux VM and not Windows. It doesn't seem to have done anything, and it's just sitting there ...
1
vote
3answers
524 views

How do I know if I have a keylogger from my Flash client on Windows 7?

I'm at work and having some issues here, so I found a lot of suspicious files involving the Flash, so I though that could be a keylogger. How do I find out if it is, and if truly is, what do I do to ...
1
vote
1answer
209 views

Is it possible to encode a Flash exploit with msfencode?

I am using a Flash exploit from metasploit, exploit/multi/browser/adobe_flash_hacking_team_uaf. The Cisco FirePOWER services notice these signatures and drop the packets. I was wondering about the ...
1
vote
2answers
1k views

Is HTML5/JavaScript more secure than Flash/Java, as the browser becomes more like an OS? [closed]

I have been asked to post this here: I want to focus on the security of the end-user in these two different scenarios: 1) Pre HTML 5 where the applications and so on lived in plug ins outside the ...
1
vote
1answer
1k views

ClamAV Flagging application .swf files as malware

ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). ...
1
vote
1answer
150 views

How can I block flash from obtaining a list of available fonts in my browser? [closed]

How can I block Flash, at least in Chrome, from obtaining the list of available fonts in my browser? It seems that the combination of fonts available is the easiest way to fingerprint a browser.
1
vote
1answer
542 views

Need an explanation of Cross-Site Flashing?

I found this - can anyone provide me examples of how these issues are exploited?
1
vote
1answer
324 views

Deliberately vulnerable Flash applications?

I'm trying to find some deliberately vulnerable Flash applications that I can practice security testing on (in the same vein as applications like the Damn Vulnerable applications). Ive noticed there ...
1
vote
1answer
61 views

Does the Flash installer use an encrypted download?

A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash ...
1
vote
1answer
924 views

Secure crossdomain for rtmp/flash streaming/wowza

I've been a bit lost. I have the following situation: Flash Player file is on https://sub.example.com/player.swf crossdomain.xml is on https://sub2.example.com/crossdomain.xml Streaming is done ...
1
vote
1answer
491 views

Stealing user cookies with flash/actionscript

I know I am asking a dumb question here, but pardon me, I am learning. I found two questions viz, How do I access cookies within Flash? and How to Make a button send an email using AS3 automatically....
1
vote
2answers
330 views

How much information a Flash program (Flash app) can gather about computer when running?

Does anyone know if a Flash web application has access to local hard drive? What about OS information or hardware information? If I allow webcam and microphone access, how much information can it get ...
1
vote
2answers
1k views

Can Hydra crack a flash-based login?

Is it possible to brute force a flash login with hydra? If not, what is a good tool to pen test a flash login?
1
vote
0answers
380 views

How can I decrypt my iphones nand flash memory if I have the pin but phone won't turn on? [closed]

Is there some sort of device I can plug my nand flash chip into and then input my pin and get my old notes and things back?
1
vote
0answers
145 views

Testing Adobe Flash - SWF Stack Corruption

For didactic purposes I have a windows 7 VM with IE11 and Adobe Flash 18.0.0.203. Also, I must test if CVE-2017-2988 can be executed on it. I have downloaded the stackbad.swf, inserted it in an index....
1
vote
0answers
109 views

Load non-existent flash file through service worker

Using Service Workers it is possible to load non-existent files with the fetch event handler, however this does not seem to work when loading flash files. Is there any way in any browser to do this ...
1
vote
1answer
2k views

How to deal with possibility of viruses on Dropbox, Google Drive, external hard drive, etc?

For home use, what is the best way to deal with viruses that could be on external storage, which seems like a great way for hackers to persist on your system even after a reformat. Maybe the best ...
1
vote
0answers
326 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way out ...
1
vote
1answer
247 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
0
votes
3answers
244 views

My Mom's Flash Player [closed]

So I am slightly more than a dilettante when it comes to security but hardly an expert. I have been reading up on the recent Adobe Flash issues and I wanted to ask a couple of questions: My Mom uses ...
0
votes
2answers
85 views

Are interactive Flash (SWF) ad banners a security threat?

Many times you have seen banners (Flash ads) on websites, where, when you move your mouse over the banner (without clicking it), you see how an animation in the banner starts moving toward your mouse ...
0
votes
1answer
233 views

What is the difference between XSS and Cross Site Flashing? [duplicate]

I want to know the basic differences between XSS and XSF
0
votes
2answers
72 views

chrome invisible flash document

I have it so flash doesn't start on page load for security and performance. Lately I have been noticing That some pages will load with a flash document that takes up the full screen. I can see it as ...
0
votes
1answer
130 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
0
votes
1answer
128 views

Encrypting folders with flash drive key?

Is there any way to have a flash drive encrypted and it will only open with one computer that has the key in it?
0
votes
3answers
950 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
0
votes
1answer
72 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
0
votes
1answer
171 views

Flash drive returning odd files, and self creating others, any ideas?

I was sanitising a USB drive and after wiping it I ran Recuva to check the results. It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, ...
0
votes
1answer
572 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
0
votes
0answers
60 views

On The Use Of Unsanboxed Plugins In The Chrome Browser

The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins. The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
188 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
0
votes
1answer
677 views

Crossdomain.xml - write access to domain

Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy? i.e. Is <cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy> the ...
0
votes
0answers
118 views

Recent persistent popups on Chrome trying to get me to download “Flash” [duplicate]

EDIT: I don't think this is 100% a duplicate, so if you've recently (around May 9th 2017) been seeing popups telling you to download Flash, I'd read on before following the link. It appears my Mac ...
0
votes
1answer
79 views

Repercussions of disabling file read and write in Adobe Flash player?

There are three settings in mms.cfg that I want to disable. It will disable file download and upload for Adobe Flash, but does it have any deeper issues? LocalFileReadDisable = 1 FileDownloadDisable =...
0
votes
1answer
84 views

Repercussions of disabling sockets in Adobe Flash player? [closed]

I am bit of a newbie to Flash exploits but I have heard that they use sockets to connect to a C&C server. According to the administration guide, I can disable sockets like this: DisableSockets = ...
-1
votes
2answers
464 views

How do researchers identify vulnerability in closed source software? [closed]

Came across an article, it is about the new BadWinmail vulnerability in Outlook. Being a closed-source software, how do researchers manage to point out that Outlook is not sandboxing the flash? Is ...
-1
votes
1answer
233 views

Secure way to run Flash on Chrome?

I kinda addicted to Little Big Snake, an online game that requires Flash. I'm trying to find a secure way to play this game on Ubuntu using Chrome. I tried Firejail but the game is very laggy with it....
-2
votes
2answers
821 views

Does Microsoft EMET protect against latest Hacking Team Adobe Flash 0-day exploit?

If I were to not update Adobe Flash and instead used the old version (from before the Hacking Team 0-day exploit was published in the internet), in that case, would Microsoft EMET protect me from the ...
-3
votes
1answer
151 views

How deeply is Adobe inside your Windows environment? [closed]

Well basically as an experienced user I am really afraid on the way that Adobe deeply resides into all my Windows based workstations. Basically in every machine that has some Adobe solution when we ...