Feeds

Researcher breaks security sandbox in Adobe Flash

Bypassing security with mhtml

Intelligent flash storage arrays

A security researcher has found a way to bypass a measure in Adobe's Flash Player that's designed to harden it against hack attacks.

Billy Rios, a Google researcher who published the method on his personal website, said it circumvents the local-with-filesystem sandbox, which is supposed to prevent Flash files loaded locally from passing data to remote systems.

By design, the so-called SWF files are locked in perimeter that can't communicate with the outside world. That's intended to thwart malicious Flash content that would otherwise locate sensitive user data and send it to machines controlled by attackers.

Rios found that the measure can be circumvented using a file:// request to a network machine. After snatching sensitive data, an attacker can simply pass it along using the GET protocol to an address such as file://\\192.168.1.1. That works on local area networks. To pass information to remote servers on the internet, attackers can use various protocol handlers that haven't been blacklisted by Adobe developers.

One such protocol is the mhtml handler, which is available on Windows and can be used without any prompts.

“Using the mhtml protocol handler, it's easy to bypass the Flash sandbox,” Rios wrote.

Well, sort of.

An Adobe spokeswoman issued a statement that read:

An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.

The company's security team has rated the bug “moderate.” ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.