By Dan Goodin in San Francisco
21st December 2007
Researchers from Google and a well-known security firm have documented
serious vulnerabilities in Adobe Flash content which leave tens of
thousands of websites susceptible to attacks that steal the personal
details of visitors.
The security bugs reside in Flash applets, the ubiquitous building
blocks for movies and graphics that animate sites across the web. Also
known as SWF files, they are vulnerable to attacks in which malicious
strings are injected into the legitimate code through a technique known
as cross-site scripting, or XSS. Currently there are no patches for the
vulnerabilities, which are found in sites operated by financial
institutions, government agencies and other organizations.
The vulnerabilities are laid out in the book Hacking Exposed Web 2.0:
Web 2.0 Security Secrets and Solutions . It is due to hit store
shelves soon, but is already in the hands of many security
professionals. The book's authors, who work for penetration testing firm
iSEC Partners as well as for Google, say a web search reveals more than
500,000 vulnerable applets on major corporate, government and media
"Lots of people are vulnerable, and right now there are no protections
available other than to remove those SWFs and wait for the authoring
tools and/or Flash player to be updated," says Alex Stamos, one of the
book's authors. "In the mean time, people will have to think: 'What kind
of flash am I using on my site,' and manually test for vulnerabilities."
That could be a mammoth task, because a half-dozen of the most popular
Flash authoring programs automatically generate the buggy content.
What's more, the people who crank out graphics frequently work
separately from a site's security team. Removing the vulnerable content
will require combing through website directories for SWF files and then
testing them one by one. Updates in the Adobe software that renders SWF
files in browsers are also expected, but they probably wouldn't quell
the threat completely, according to Stamos.
The authors have been working since the summer with Adobe, the developer
of Flash, and the United States Computer Emergency Readiness Team to
coordinate a remedy. An Adobe representative said patches should be
released in the next few weeks. In the meantime, end users can employ
the Firefox plug-in NoScript or use other methods to block Flash on
sensitive websites. Flash content creators can also utilize the data
validation libraries found here, as well as follow the guidelines of
this Adobe whitepaper.
A security update Adobe released this week for its Flash player doesn't
fix the vulnerabilities, Stamos said.
Attack scenarios work something like this: A bank website hosts
marketing graphics in the form of a vulnerable Flash applet. Attackers
who trick a customer into clicking on a malicious link are able to
execute the SWF file but inject malicious code variables that cause the
customer's authentication cookies or login credentials to be sent to the
"There are definitely lots of people who are vulnerable," Stamos said.
"Tens of thousands is very conservative. Realistically, it's probably in
the hundreds (of thousands)."
Shockwave to the system
One reason for the sheer volume of vulnerable applets: SWF files
generated by six of the more popular content development tools
automatically contain the bugs, according to the book. Those programs
include DreamWeaver, Connect, Breeze - which are sold by Adobe - and
TechSmith Camtasia, InfoSoft FusionCharts and software from Autodemo.
Stamos said Adobe is likely to update its Flash Player so it does a
better job of vetting code variables before executing SWF files. But he
said interaction with third-party code is such a core part of the way
Flash works that updates to the player would likely provide only a
Eradicating the problem will require updates for all of the graphics
authoring tools so they no longer generate buggy Flash content. Even
then, security pros will have to analyze all of a website's SWF files
and recompile any found to be vulnerable.
The book was authored by Rich Cannings, a senior information security
engineer at Google, and Himanshu Dwivedi, Zane Lackey, Chris Clark and
Stamos of iSEC. It is published by The McGraw-Hill Companies.
Visit InfoSec News