Feeds

Researcher breaks security sandbox in Adobe Flash

Bypassing security with mhtml

Build a business case: developing custom apps

A security researcher has found a way to bypass a measure in Adobe's Flash Player that's designed to harden it against hack attacks.

Billy Rios, a Google researcher who published the method on his personal website, said it circumvents the local-with-filesystem sandbox, which is supposed to prevent Flash files loaded locally from passing data to remote systems.

By design, the so-called SWF files are locked in perimeter that can't communicate with the outside world. That's intended to thwart malicious Flash content that would otherwise locate sensitive user data and send it to machines controlled by attackers.

Rios found that the measure can be circumvented using a file:// request to a network machine. After snatching sensitive data, an attacker can simply pass it along using the GET protocol to an address such as file://\\192.168.1.1. That works on local area networks. To pass information to remote servers on the internet, attackers can use various protocol handlers that haven't been blacklisted by Adobe developers.

One such protocol is the mhtml handler, which is available on Windows and can be used without any prompts.

“Using the mhtml protocol handler, it's easy to bypass the Flash sandbox,” Rios wrote.

Well, sort of.

An Adobe spokeswoman issued a statement that read:

An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.

The company's security team has rated the bug “moderate.” ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?