5 ms·

Flash 0-day exploit

87 points by bpierre 15y ago

trotsky 15y ago
At least VUPEN restricts who they sell to. "Step Ahead" sounds like they've dropped even the pretense of being for pen testers.
- dsl 15y ago
  I think you mean Intevydis, "Step Ahead" is the name of the product. Immunity makes the framework all these exploit packs plug into and acts as the primary sales channel for them. They do a pretty good job of keeping the undesirables out, but like any other desirable software product copies do have a tendency to grow legs and follow employees home.
  - trotsky 15y ago
    No, I meant the product line - you don't get this bug in their "pro" version, only "step ahead" - step ahead of the vendors presumably. It seems hard to believe that private 0-days are legitimate pentesting apparatus - what are you testing in this case, whether your enterprise runs software that someone might find a bug in in the future? As far as I understand it canvas/Immunity is firmly in the offensive security market anyway, aren't they actively part of the scene that derides "killing bugs" aka reporting security bugs to software vendors (for any price)? I'm sure this bug hasn't been reported to Adobe, all they'd be doing is closing their marketing window.
MHBerryman 15y ago
I find it amazing that browsers do not block Flash from running by default. I've posted the Chrome help page[1] that shows how to block and selectively unblock plugins to my Facebook/Twitter, as I really don't want to return home for the holidays to have lots of repair requests. [1] http://support.google.com/chrome/bin/answer.py?hl=en-GB&answer=142064 http://support.google.com/chrome/bin/answer.py?hl=en-GB&...
- noduerme 15y ago
  I find chrome and ff are much more often dead-crashed by a single line of Javascript than tons of flash. Firefox even re-crashes when you open it again in many cases, without letting you prevent reloading of the offending Javascript.
  - IChrisI 15y ago
    If Firefox crashes when you restart it, the next time it starts it lets you choose which tabs to re-open. This solves the problem of something repeatedly crashing it.
  - rjbond3rd 15y ago
    Only if you the user decide to re-open all of the tabs again (i.e., make no attempt to determine the offending tab).
- deleted 15y ago
  [deleted]
codecaine 15y ago
one word: Flashblock
- there 15y ago
  flashblock is not good at blocking flash from a security standpoint. with it enabled, visit http://lcamtuf.coredump.cx/html5object/ http://lcamtuf.coredump.cx/html5object/ and you'll probably see at least one flash animation start. http://lcamtuf.blogspot.com/2011/03/warning-object-and-embed-are-inherently.html http://lcamtuf.blogspot.com/2011/03/warning-object-and-embed...
  - Natsu 15y ago
    Maybe flashblock isn't good enough, but when combined with noscript, it didn't let anything on that page slip through.
    - there 15y ago
      noscript natively supports blocking embedded things with a click-to-activate interface, so if you're using noscript there's no need for flashblock.
      - bobds 15y ago
        The thing I like about NoScript is that you can set it to block everything, even on trusted sites. You have to click the placeholder to make it load, or if there isn't a placeholder (web fonts, hidden flash embeds) you have to look at the Blocked menu.
    - deleted 15y ago
      [deleted]
  - kevingadd 15y ago
    Thanks for the link to that demonstration. Hadn't seen anything bypass flashblock before. Switched to NoScript and confirmed that it actually blocks all of the test cases.
unabridged 15y ago
and this is why I don't have flash installed
- wladimir 15y ago
  This was also the last straw for me. It's just not worth the risk anymore of the extra attack surface it exposes. I've uninstalled flash from all my machines and disabled it in chrome.
joeybaker 15y ago
about:plugins in chrome to disable flash.
- deleted 15y ago
  [deleted]
- piggity 15y ago
  Good tip I had a surprising number of random players installed too. e.g. Silverlight - requiring a critical update; amongst other plugins that I never even use any more.
missing_cipher 15y ago
I'm expecting Chrome/Google to patch this vulnerability before Adobe does.
- trotsky 15y ago
  Google has a source license for Flash - they just get the fixes from Adobe before they've passed QA in all of their products. Google doesn't actually develop their own fixes in these cases - they just ship them faster.
x5315 15y ago
In the video he says that he's using the latest version of IE, but it's IE8. I'm not sure it'll make a difference, but maybe it could.
- dedward 15y ago
  Presumably it is win xp? Ie9 doesnt go there.
toodlestech 15y ago
Has anyone even tried it? At first glance it tried to run a quicktime plugin through flash but you have to explicitly allow it with the default settings of modern browsers. Not much different than explicitly downloading a virus and executing it.
ck2 15y ago
I don't understand - doesn't the security community usually give the vendors a heads-up before they announce? Did Adobe just ignore them? How does the 11.2 beta fair against the exploit? http://labs.adobe.com/technologies/flashplatformruntimes/flashplayer11-2/ http://labs.adobe.com/technologies/flashplatformruntimes/fla...

87 points by bpierre 15y ago

At least VUPEN restricts who they sell to. "Step Ahead" sounds like they've dropped even the pretense of being for pen testers.

dsl 15y ago
I think you mean Intevydis, "Step Ahead" is the name of the product. Immunity makes the framework all these exploit packs plug into and acts as the primary sales channel for them. They do a pretty good job of keeping the undesirables out, but like any other desirable software product copies do have a tendency to grow legs and follow employees home.
- trotsky 15y ago
  No, I meant the product line - you don't get this bug in their "pro" version, only "step ahead" - step ahead of the vendors presumably. It seems hard to believe that private 0-days are legitimate pentesting apparatus - what are you testing in this case, whether your enterprise runs software that someone might find a bug in in the future? As far as I understand it canvas/Immunity is firmly in the offensive security market anyway, aren't they actively part of the scene that derides "killing bugs" aka reporting security bugs to software vendors (for any price)? I'm sure this bug hasn't been reported to Adobe, all they'd be doing is closing their marketing window.

MHBerryman 15y ago

I find it amazing that browsers do not block Flash from running by default. I've posted the Chrome help page[1] that shows how to block and selectively unblock plugins to my Facebook/Twitter, as I really don't want to return home for the holidays to have lots of repair requests. [1] http://support.google.com/chrome/bin/answer.py?hl=en-GB&answer=142064 http://support.google.com/chrome/bin/answer.py?hl=en-GB&...

noduerme 15y ago
I find chrome and ff are much more often dead-crashed by a single line of Javascript than tons of flash. Firefox even re-crashes when you open it again in many cases, without letting you prevent reloading of the offending Javascript.
- IChrisI 15y ago
  If Firefox crashes when you restart it, the next time it starts it lets you choose which tabs to re-open. This solves the problem of something repeatedly crashing it.
- rjbond3rd 15y ago
  Only if you the user decide to re-open all of the tabs again (i.e., make no attempt to determine the offending tab).
deleted 15y ago
[deleted]

codecaine 15y ago

one word: Flashblock

there 15y ago
flashblock is not good at blocking flash from a security standpoint. with it enabled, visit http://lcamtuf.coredump.cx/html5object/ http://lcamtuf.coredump.cx/html5object/ and you'll probably see at least one flash animation start. http://lcamtuf.blogspot.com/2011/03/warning-object-and-embed-are-inherently.html http://lcamtuf.blogspot.com/2011/03/warning-object-and-embed...
- Natsu 15y ago
  Maybe flashblock isn't good enough, but when combined with noscript, it didn't let anything on that page slip through.
  - there 15y ago
    noscript natively supports blocking embedded things with a click-to-activate interface, so if you're using noscript there's no need for flashblock.
    - bobds 15y ago
      The thing I like about NoScript is that you can set it to block everything, even on trusted sites. You have to click the placeholder to make it load, or if there isn't a placeholder (web fonts, hidden flash embeds) you have to look at the Blocked menu.
  - deleted 15y ago
    [deleted]
- kevingadd 15y ago
  Thanks for the link to that demonstration. Hadn't seen anything bypass flashblock before. Switched to NoScript and confirmed that it actually blocks all of the test cases.

unabridged 15y ago

and this is why I don't have flash installed

wladimir 15y ago
This was also the last straw for me. It's just not worth the risk anymore of the extra attack surface it exposes. I've uninstalled flash from all my machines and disabled it in chrome.

joeybaker 15y ago

about:plugins in chrome to disable flash.

deleted 15y ago
[deleted]
piggity 15y ago
Good tip I had a surprising number of random players installed too. e.g. Silverlight - requiring a critical update; amongst other plugins that I never even use any more.

missing_cipher 15y ago

I'm expecting Chrome/Google to patch this vulnerability before Adobe does.

trotsky 15y ago
Google has a source license for Flash - they just get the fixes from Adobe before they've passed QA in all of their products. Google doesn't actually develop their own fixes in these cases - they just ship them faster.

x5315 15y ago

In the video he says that he's using the latest version of IE, but it's IE8. I'm not sure it'll make a difference, but maybe it could.

dedward 15y ago
Presumably it is win xp? Ie9 doesnt go there.

toodlestech 15y ago

Has anyone even tried it? At first glance it tried to run a quicktime plugin through flash but you have to explicitly allow it with the default settings of modern browsers. Not much different than explicitly downloading a virus and executing it.

ck2 15y ago

I don't understand - doesn't the security community usually give the vendors a heads-up before they announce? Did Adobe just ignore them? How does the 11.2 beta fair against the exploit? http://labs.adobe.com/technologies/flashplatformruntimes/flashplayer11-2/ http://labs.adobe.com/technologies/flashplatformruntimes/fla...