Feeds

Researcher breaks security sandbox in Adobe Flash

Bypassing security with mhtml

Security for virtualized datacentres

A security researcher has found a way to bypass a measure in Adobe's Flash Player that's designed to harden it against hack attacks.

Billy Rios, a Google researcher who published the method on his personal website, said it circumvents the local-with-filesystem sandbox, which is supposed to prevent Flash files loaded locally from passing data to remote systems.

By design, the so-called SWF files are locked in perimeter that can't communicate with the outside world. That's intended to thwart malicious Flash content that would otherwise locate sensitive user data and send it to machines controlled by attackers.

Rios found that the measure can be circumvented using a file:// request to a network machine. After snatching sensitive data, an attacker can simply pass it along using the GET protocol to an address such as file://\\192.168.1.1. That works on local area networks. To pass information to remote servers on the internet, attackers can use various protocol handlers that haven't been blacklisted by Adobe developers.

One such protocol is the mhtml handler, which is available on Windows and can be used without any prompts.

“Using the mhtml protocol handler, it's easy to bypass the Flash sandbox,” Rios wrote.

Well, sort of.

An Adobe spokeswoman issued a statement that read:

An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.

The company's security team has rated the bug “moderate.” ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Apple grapple: Congress kills FBI's Cupertino crypto kybosh plan
Encryption would lead us all into a 'dark place', claim G-Men
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.