Slashdot Mirror
HP's Free Adobe Flash Vulnerability Scanner
Catalyst writes "SWFScan is a free Flash security tool (download here), released by HP Software, which decompiles all versions of Flash and scans them for over 60 security vulnerabilities. The scan detects things like XSS, SQL inside of the Flash app, hard-coded authentication credentials, weak encryption, insecure function calls, cross-domain privilege escalation, and violations of Adobe's security recommendations. There is also this video explaining a real, and amusing, attack against a Flash app. These issues are fairly widespread, with over 35% of SWF applications violating Adobe security advice."
Can they also make SFWScan?
That would help avoid potentially embarrassing situations at work.
There's no -1 for "I don't get it."
... a vulnerability scanner for Windows Vista, for silverlight. If/when they do I will agree HP's intentions are bona fide.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Flash finally has an accountability and score card.
Unless they make it into a Firefox plug-in that checks the flash code before running it, just what good is this?
I'm an American. I love this country and the freedoms that we used to have.
Em, don't know too much about laws and stuff, but doesn't anyone at HP see the potential copyright troubles with transforming flash bytecode to source?
I guarantee it!
Actually I am more curious about the decomipiling process than the actual vulnerability scanner.
I am thinking about learning just a little flash to see "what it's all about" and I (partially due to being lazy) would really like to see if the output of this program is useful in any way.
if the post -- or even the site -- had mentioned that the tool was for Windows only, so that I did not have to register first and then find out.
"Blinded by Flash: Widespread Security Risks Flash Developers Don't See"
From the presentations description:
"In this presentation I will examine the Flash framework and then delve into the Flash security model and the transitions it has undergone over the years. To explore the avenues of compromise in the security model, I will use a test Flash application and demonstrate various attack vectors including Cross-Site Request Forgery, data injection and script injection. During this demonstration, I will explain the associated threats in detail and discuss means to mitigate these threats. Even though the test application validates the attack surface, the question remains: how many applications actually deployed are vulnerable to these threats? I will answer this question by providing astonishing statistics about vulnerable, real world applications I was able to find using simple Google queries."
The pdf of her presentation is here:
https://www.blackhat.com/presentations/bh-dc/Jagdale/BlackHat-DC-09-Jagdale-Blinded-by-Flash.pdf
Though I haven't had a chance to evaluate it just yet, I think this is a step in the right direction. Flash security is often overlooked, while Flash itself is often overused by designers who think that pretty effects make the web page. It gets especially bad when Flash is used for activities that require some sort of security, such as a login form. 99% of the time, instead of POST'ing that information to a server side script, it's handled inside the SWF file. Since these can be easily decompiled (grab a copy of Flare or any other decompiler), the password is easily revealed. I recently found a network product which went through the trouble of XOR'ing a password and storing in a text file. Two problems: the text file was in the web root, and the XOR key was inside the SWF. Tools like this can only raise awareness of these types of issues.
I didn't make the first post.
So naturally my first thought was, I wonder how well youtube does.
And lo: it's got 7 vulnerabilities.
It's interesting how this behemoth of a flash provider is still not secure.
*reaches for tinfoil hat*
I tried this on an SWF file created with the Adobe Captivate "publish" feature and it fails pretty badly with lots of vulnerabilities.
Assuming they have the source code, in the example given, how WERE they supposed to do it? The only thing I can think of is "When they make a query, run a procedure on a database that takes the IP, stores it, and Increments a value ("wins per day")"
Excellent question.
Unfortunately, IP addresses aren't reliable for this purpose. However, in order to win you have to provide your e-mail address, and the coupon is e-mailed to you. The simplest solution would be to store e-mail addresses in the database and (as you suggest) limit the wins per day for each e-mail address. Another idea is to generate a unique ID for each visitor to the site (using cookies), and make sure one user doesn't submit requests with multiple e-mail addresses.
Of course, what's not mentioned in the video is an even bigger potential security hole: if the coupon is supposed to be printed out, and then redeemed for a cheeseburger, there's nothing to stop someone from printing multiple copies of the same e-mail. Unless, of course, each coupon has a unique ID that must be verified against a central database. Most places solve this problem by printing "Limit one per customer" on the coupon, which would apply equally to multiple coupons received from multiple wins of the game.
Now I want a cheeseburger. Excuse me.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/images/SwfScan.msi
It sounds like SWFScan actually scans flash SWF files, not flash itself like the post suggests.
"I can haz cheezeburger? For LIFE?"
How much is your data worth? Back it up now.
I would never trust HP with anything with the word 'security' in it. I worked in the service department in the largest computer retailer in Australia (Harvey Norman) for 8 years and still work in the industry. HP, for as long as I can remember, have been putting a backdoor trojan called "Backweb" in their computers for years. They now call it "Updates from HP", but it's the same program. Early versions of Spybot S&D (from the 2003 era) removed it as a threat, as did several other spyware scanners.
I had the opportunity to have a one-on-one meeting with the managing director of HP Australia a few years ago and asked him a bunch of loaded questions. Among those questions was "Why do HP put spyware in their computers?" He had no idea what I was on about, so I showed him. Right there, I took a brand new HP out of the box, plugged it in, installed spybot and ran it. It removed several instances of spyware, namely "Backweb".
He had no answer. I told him to call whoever controls this and he did (to his credit). He was told by the guy that it's so HP can push through updates. I asked him "What updates? Is the user informed? Is all this in the license agreement?" He gave up on me and walked out.
So, yea. HP and Security? Ummm... no.
You moved your mouse. Please restart Windows for changes to take effect.
I love decompliers ... nothing like ripping something apart and finding out what makes it tick!
Gage
www.impostormag.com
So *after* the direct link to the video was posted on Slashdot, I was watching the video and the counter tells me that I'm no. 271 to watch this video. Amazing how incredibly serious people are about this kind of stuff. Now I picture the thousands of web developers starting to use the suggested security guidelines..
Many tools that are released today are automatically released for Windows, OS X, and Linux. I did not expect them to have a version for each, but considering the number of people today who use an OS other than Windows, it is a rather common courtesy to at least stipulate what OS(s) your program runs under.
I have XP in a VM, but considering how little I use it, and what for, I am just plain not interested in a Windows version of the program. Too much of a pain in the butt.
A few years ago I remember seeing a tool called SWFEncrypt, which claimed to do "encryption" on an SWF file. That's an interesting statement to make, seeing as there is no flipping way the Flash Player would be able to play an encrypted movie, but whatever; the company didn't seem to be very forthcoming about much. Anyhow, it basically did some heavy obfuscation on the Flash movie that breaks most SWF decompilers (until the decompiler folks figure out how to work around the obfuscation techniques).
http://www.amayeta.com/software/swfencrypt/