Feeds

Adobe Flash attack vector exploits insecure web design

User-supplied malware upload peril

Next gen security for virtualised datacentres

An unpatched security risk involving Adobe Flash creates a possible mechanism for hackers to load exploits onto websites.

The vulnerability was discovered by security researchers at Foreground Security and reported to both Adobe and Google, whose Google Applications, including Gmail, are potentially vulnerable to exploit.

No fix is currently available. However, exploitation of the security flaw would be far from straightforward, especially on Gmail because hackers would have to figure out message IDs in order to create any mischief. Foreground has not detected any attacks using the technique, which affects sites that allow users to upload active content onto trusted domains.

Proof of concept demos on the vulnerability created by Foreground revolve around the misuse of Adobe Flash to potentially booby-trap targeted websites with drive-by download exploits. One (now fixed) Gmail Exploit that revolves around the misuse of Adobe Flash can be found below.

The threat is far from restricted to Adobe Flash and could involve other forms of active content, including JavaScript. The root cause of the problem arguably lies with insecure web design practices that are deeply ingrained on the internet.

Brad Arkin, Adobe's director for product security and privacy, explained that simply patching Flash won't solve the problem. "We see this as a generic problem that affects any site that allows active scripting, not just Flash, but things like JavaScript and Silverlight as well," Arkin told Computerworld. "Sites should not allow user uploads to a trusted domain."

Mike Bailey, the senior researcher who first documented the vulnerability, agreed with that point while adding that Adobe also has a role to play in fixing the problem.

"For website owners, all user-supplied content should be served from a completely separate domain,” Bailey said. "This is already implemented by Yahoo mail, Hotmail, Wikipedia, and many other major websites, but a huge variety of self-contained web applications do not do so."

"The ideal fix should involve Adobe implementing a more sensible origin policy for Flash objects," Bailey added. However, the downside of making Flash more secure in this way is that it would break legitimate (though arguably badly coded) functionality on many sites.

Surfers are advised to mitigate against the possible risk of attack by disabling Flash in their browsers or by using browser plug-ins, such as NoScript for Firefox or ToggleFlash for IE, to reduce their exposure whenever possible.

More detail on the vulnerability can be found in Foreground Security advisory here. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?