Security Researcher Defeats Adobe Flash Sandbox

Flash expert Billy Rios bypassed Flash Player feature meant to prevent malicious attacks.

(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
A security feature added to harden Adobe Flash Player against attacks has been defeated.
Security researcher
Billy Rios
on Tuesday said that hes discovered an easy way to bypass Flashs local-with-file system sandbox.
Adobe added the sandbox to Flash Player version 8. After facing heavy criticism for the number of security vulnerabilities present in Flash -- as well as Reader and Acrobat -- which attackers
exploited heavily
in 2010, Adobe also added a
security sandboxes
to Flash Player for Google Chrome, as well as for Reader X for Windows. The latter two applications sandboxes werent bypassed by Rios.
The Flash Player sandbox was meant to prevent SWF files, used by Flash, from reading local files or communicating with the network in any manner, thereby blocking many types of malicious attacks. According to Adobe documentation, the sandbox assures the user that local data cannot be leaked out to the network or otherwise inappropriately shared.
But Rios labels that description a bit too generous. While its true that SWF files cant call JavaScript or make direct HTTP or HTTPS requests, they can make file requests to a remote server. Accordingly, an attacker -- or security researcher such as Rios, developing a proof of concept exploit -- can resort to a few tricks for sidestepping the sandbox restrictions to inappropriately share information.
In particular, Rios tapped the mhtml protocol handler thats built into Windows 7 and which will launch with no warning to the user. With mhtml, its easy to bypass the Flash sandbox, he said, and transmit data to a remote server without a user ever knowing that the exploit occurred.
Whats notable with this vulnerability is that Rios wrote no attack code, but rather just used capabilities built into the Windows operating system to sidestep the sandbox.
This is a flaw in design, its not a flaw in implementation or coding, said Anup Ghosh, founder and chief scientist of Invincea, which develops browser and PDF sandboxes that use local, throwaway virtualized environments, rather than building a sandbox inside an application, as Adobe did.
When youre writing a sandbox for an application, you have to think about every possible way that an attacker could hit you, and then design a block or Band-Aid for each of those techniques, said Ghosh. But Rios basically exposed the fallacy of that thinking, because an attacker only has to find one communication protocol -- from one of thousands of libraries -- that isnt explicitly blocked.
Adobe acknowledged the vulnerability, rating it as moderate, which hints at the potential difficulty of translating the vulnerability into a malicious exploit.
An attacker would first need to gain access to the users system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively, according to a statement released by Adobe. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Security Researcher Defeats Adobe Flash Sandbox