Graham Perrin's List: protecting against malware that uses Adobe Flash

• ClickToFlash
• Flash-blocking
• for Safari on Mac OS X
• Lowered CPU usage
• View blocked Flash with just one click
• videos in QuickTime
• Whitelist

5 more annotations...

• Re http://twitter.com/grahamperrin/status/5820938373 I use ClickToFlash as a complement to anti-virus software. - Graham Perrin on 2009-11-18

• For Latest Developer Builds of Chrome 4.0+
• for Chrome
• FlashBlock

1 more annotation...

• Ad Blocker
• remove banners, image ads and flash ads
• Block ad sites
• Enable/Disable Flash Block

2 more annotations...

• How to block Flash Ads (and movies) in Internet Explorer
• July 28, 2009
• open up the add-on manger from the tools menu
• select All Add-ons
• Select toolbar and extensions from the left hand pane
• Shockwave Flash Object
• double click
• More Information dialog
• revoke access to the player
• Remove All Sites
• when ever you land on site with an embedded Flash movie (or add), you’d see a yellow notification bar asking you if you want to run the player

9 more annotations...

• Complicated. - Graham Perrin on 2009-11-18

• FlashBlock
• extension for the Mozilla, Firefox, and Netscape  browsers
• placeholders
• to  download and then view the Flash

2 more annotations...

• User-friendly. - Graham Perrin on 2009-11-18

• NoScript Firefox extension
• JavaScript, Java and Flash and other plugins  to be executed only by trusted web sites
• your choice
• whitelist based pre-emptive script blocking

2 more annotations...

• ClickToFlash
• and caution
• in addition to Sophos Anti-Virus

1 more annotation...

• on access
• scans files on-disk
• not network traffic to the browser
• in reply to grahamperrin

2 more annotations...

• on Mac OS X
• d

  oes Sophos on-access scanning include the HTTP data stream?
• http://ur1.ca/fyp4
• http://ur1.ca/fyp9

2 more annotations...

• a new form akin to the

  1

  one-time-pad concept is now being deployed
• only for a second in a day
• Malware
• Malware authors and software-protectionists alike go to great lengths to obfuscate and contort their code in an attempt to hide or obscure its true nature
• one-time-pad

  • http://en.wikipedia.org/wiki/One-time_pad
  Add Sticky Note
• when that script is submitted by the customer for analysis
• the environment has long been destroyed
• nearly impossible to decode
• quite likely malicious
• PDF, or Flash element
• any scanning engine which has access to the HTTP data stream should be able to cope
• the only real way to tackle this problem is
• Just in time
• failing that, NoScript remains your best protection
• on-access

  • Sophos Anti-Virus on-access scanning does <b>not</b> include network traffic to the browser:
    http://www.diigo.com/annotated?url=http%3A%2F%2Ftwitter.com%2FSophosLabs%2Fstatus%2F5798424527&uid=26573

  • On Mac OS X, does Sophos on-access scanning include the HTTP data stream? http://twitter.com/grahamperrin/status/5797623093
  Add Sticky Note
• November 16th, 2009

14 more annotations...

• 15 November 2009
• Adobe Responds... Sort Of
• Adobe has published a response to the latest issues
• dodge the issues
• Adobe continues to compare this to uploading Javascript files.

  Here's the difference:
• Flash's handling of potential code is clearly MUCH more permissive than Javascript's.
  
• a Flash file can look like anything to the server and still be executable
• simply changing the file's extension is enough to bypass upload restrictions
• aren't easy to implement
• solutions for the security administrator
• serve user-generated files with the content-disposition: attachment header
• hardly an ideal solution
• The Same Origin Policy is a completely separate issue from the execution of the content
• If a Flash file hosted on foo.com is embedded in a web page on bar.com, that file can run Actionscript on foo.com, as well as execute Javascript on bar.com
• Mike Bailey

13 more annotations...

• This stuff makes me dizzy, I can't pretend to understand the whole caboodle but it's remarkable that:
  
  a) Adobe's response mentions the research without providing a reference
  
  b) unless I'm missing something, no word on the subject from Sophos. - Graham Perrin on 2009-11-15
• http://www.foregroundsecurity.com/MyBlog/adobe-responds-sort-of.html no longer found, error 404.
  
  http://blog.skeptikal.org/2009/11/adobe-responds-sort-of.html remains. - Graham Perrin on 2011-04-09

• Adobe Secure Software Engineering Team
• Flash content and the same-origin policy
• Peleus Uhley
• November 13, 2009
• Research was recently published

  • What, no reference? Why so shy?
  Add Sticky Note
• Web servers that choose to accept user-uploaded content also choose to accept the risks that go along with that functionality
• step back
• two pieces of content hosted on the same domain and loaded by the same protocol trust each other
• understand the same-origin policy
• same-origin policy is enforced by the web browser
• Law #4 of Microsoft's 10 Immutable Laws of Security, "If you allow a bad guy to upload programs to your web site, it's not your web site anymore."
• When Flash content (SWF), as well as any other web content, is hosted on the same domain as the surrounding HTML, the same-origin policy defines a trust relationship
• solve the problem by hosting untrusted content on a different domain
• headers, which instruct Flash Player to treat the file as an attachment. Flash Player will
• present an Open/Save/Cancel dialogue
• educate the community

14 more annotations...

• referred from http://www.diigo.com/bookmark/http%3A%2F%2Fwww.foregroundsecurity.com%2FMyBlog%2Fadobe-responds-sort-of.html?tab=comment&uname=grahamperrin - Graham Perrin on 2009-11-15

• The threat is far from restricted to Adobe Flash and could involve other forms of active content, including JavaScript
• deeply ingrained on the internet
• simply patching Flash won't solve the problem
• generic problem that affects any site that allows active scripting, not just Flash, but things like JavaScript and Silverlight
• Sites should not allow user uploads to a trusted domain
• Mike Bailey, the senior researcher who first documented the vulnerability, agreed with that point
• all user-supplied content should be served from a completely separate domain
• a huge variety of self-contained web applications do not do so
• The ideal fix should involve Adobe implementing a more sensible origin policy for Flash objects

7 more annotations...

• 13 November 2009
• Flash Origin Attack FAQ
• A lot of people don't fully understand it
• it is a single, basic issue that enables this exploit
• the
  intersection of that and several others
• makes it critically bad
• an uploaded file can attack a server
• focus of this research
• Flash player will execute any file it is asked to execute
• this may be a browser issue as well
• the plugin itself should also verify that the proper content-type is sent in the server's response HTTP headers
• before executing
• Flash's plugin does not do so
• This attack abuses the user to attack the server
• issue requests to, and read the results from the server
• The web application, and any data or functionality within, is now accessible to the attacker
• Adobe considers this to be the web administrators' problem
• Adobe's expectation of administrators to prevent this issue is unrealistic
• expecting website administrators to understand, not to mention be able to fix this issue is ridiculous and unrealistic
• Adobe is uniquely in a position to create a client-side fix
• Until they do so, many websites will remain vulnerable

19 more annotations...

• referred from http://www.diigo.com/bookmark/http%3A%2F%2Fwww.foregroundsecurity.com%2FMyBlog%2Fflash-origin-policy-issues.html?tab=comment&uname=grahamperrin via http://www.computerworld.com/s/article/9140768/Flash_flaw_puts_most_sites_users_at_risk_say_researchers - Graham Perrin on 2009-11-14

• Flash flaw puts most sites, users at risk
• hijack sites, attack users
• Gregg Keizer
• Hackers can exploit a flaw in Adobe's Flash to compromise nearly every Web site that allows users to upload content
• November 12, 2009
• silent attacks on visitors to those sites
• "The magnitude of this is huge," said Mike Murray, the chief information security officer at Orlando, Fla.-based Foreground Security. "Any site that allows user-uploadable content is vulnerable, and most are not configured to prevent this."
• problem lies in the Flash ActionScript same-origin policy
• malicious scripts in the context of that domain
• frighteningly bad
• Adobe is trying to educate site administrators
• they've not had much success
• the problem can't be solved with a patch to Flash
• Adobe's director for product security and privacy
• things like JavaScript and Silverlight as well
• danger of allowing users to upload
• Sites should not allow user uploads to a trusted domain
• most sites haven't taken that advice
• very few system administrators are even aware
• How can Adobe expect others to protect themselves when they can't do it themselves?
• some of Adobe's Web properties are vulnerable
• Foreground has not detected any in-the-wild attacks using the technique
• hackers are moving toward such tactics
• best mitigation is to not use Flash
• This has the potential to affect any social media site, any career site, any dating site, many retail sites and many cloud applications. That's why this attack is so serious.
• End users would never know they got exploited.

  • What about protection against malware? Do none of the products protect against such things?
  Add Sticky Note

24 more annotations...

• 13 November 2009
• Flash Origin Policy Issues
• a way to attack the way that browsers handle Adobe Flash objects
• exploited to allow nearly any site that allows user generated content to be attacked
• No fix
• if I can convince a server to serve up a file on my behalf, I can use that file to attack the server
• For users trying to protect themselves, disabling Flash completely is the only way to be sure
• all user-supplied content should be served from a completely separate domain
• a huge variety of self-contained web applications do not do so
• According to Adobe
• no easy solution. This issue is very difficult to solve
• Mike Bailey
• ClickToFlash
• http://rentzsch.github.com/clicktoflash/
• this isn't FUD
• FAQ about this

  • http://www.foregroundsecurity.com/MyBlog/flash-origin-attack-faq.html
  Add Sticky Note

14 more annotations...

• referred from http://www.computerworld.com/s/article/9140768/Flash_flaw_puts_most_sites_users_at_risk_say_researchers - Graham Perrin on 2009-11-14

• Web advertisements - a significant spreading vector for malware
• 2009-10-07
• Malicious advertisements may appear in various forms
• Flash advertisements that exploit vulnerabilities

  • <b><font color="red">Anti-virus software alone may not protect</font></b> against such exploits.
  Add Sticky Note
• Banner images that link to malicious web sites (pretending to be legitimate),
• Banner images that download malicious software when clicked
• average web users may use blockers

5 more annotations...