Adobe Flash Security on Menu at Black Hat

Security vulnerabilities in Adobe Systems’ applications have increasingly become a popular target for attackers in the past year.

At Black Hat DC, Foreground Security Senior Security Researcher Mike Bailey will examine Flash’s security model and take a look at some of the ways attackers can leverage Adobe Flash vulnerabilities to compromise a system.

“This is very different from the attacks that have previously been performed on the Flash Player- I am not exploiting bugs in code or trying to compromise the user's system,” he told eWEEK. “Instead I am attacking the interaction of Flash player, the Web browser and the Websites.”

Bailey said his talk won't deal with zero-day exploits in Flash Player, but rather poor programming practices and Web architectures. Since Flash objects are self-contained and execute client-side, they are not generally considered dangerous to a Website owner, he said.

“My goal is to dispel that myth by demonstrating exactly how dangerous they can be,” he said.

"In the past, I've compared Flash to JavaScript," he continued. "With that analogy, the attacks that have been previously performed were akin to looking for stack overflows in a JavaScript parser, but completely ignoring cross-site scripting as an attack vector. With that approach, some classic attacks (cross-site scripting, cross-site request forgery) can be performed using flawed Flash objects, server-side logic or other issues."

Bailey noted that Adobe has already published documentation on secure coding and Website maintenance practices, but said additional efforts to improve developer and user education would be helpful.

  
“Adobe has excellent developers and security engineers working on it, and it is constantly being improved,” he said. “It does, however, present significant risk to Websites that is not being considered, much less addressed.”

“There are some changes that could be made to Flash Player which would be helpful, but doing so would break many Websites and poorly designed Flash applications,” he continued. “Naturally, that is a difficult tradeoff, and it is Adobe's decision to make, but due to Flash's ubiquity…I believe they have a responsibility to help secure their users.”

Bailey’s presentation will take place Feb. 2. The conference will run from Jan. 31 to Feb. 3 in Arlington, Va.