Comments on: Encapsulating CSRF attacks inside massively distributed Flash movies – Real world example http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/ Flash And Everything Else Thu, 11 Mar 2010 23:41:10 +0000 http://wordpress.org/?v=abc hourly 1 By: Artiaga http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-3280 Artiaga Thu, 11 Mar 2010 23:41:10 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-3280 I've read sobe posts and i like your blog.I'm just start8ng up my own and only hope that i can write as well , thanks!.; I've read sobe posts and i like your blog.I'm just start8ng up my own and only hope that i can write as well , thanks!.;

]]> By: games http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-3117 games Fri, 05 Mar 2010 15:06:33 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-3117 I've read some posts and i like your blog.I'm just starting up my own and only hope that i can write as well , thanks!. I’ve read some posts and i like your blog.I’m just starting up my own and only hope that i can write as well , thanks!.

]]> By: High speed movies online http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-3104 High speed movies online Fri, 05 Mar 2010 06:44:39 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-3104 Hey! Very good post,I like it,I hope you'll continue doing great job! Hey! Very good post,I like it,I hope you’ll continue doing great job!

]]> By: Making Money » Blog Archive » What are ways of making money for copyright and having a website? http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-289 Making Money » Blog Archive » What are ways of making money for copyright and having a website? Tue, 25 Nov 2008 19:59:30 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-289 [...] GUYA.NET » Blog Archive » Encapsulating CSRF attacks inside … [...] [...] GUYA.NET » Blog Archive » Encapsulating CSRF attacks inside … [...]

]]> By: guya http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-288 guya Mon, 22 Sep 2008 13:23:50 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-288 Adobe knows about this. Again, all that is needed to make this kind of attack much less effective is to default the allowScriptAccess to "never". I guess Adobe don't wont to break any more existing applications for the sake of security. Every change in the behavior of an existing feature cause some applications to break and frustration for their developers. Every Flash Player release gets more secure, similar to the browsers and most platforms. Apparently this fix won't get into the upcoming release of Flash 10 which already have its share of similar security updates, Maybe latter. let me just clarify that CSRF flaws aren't Flash related, it relate to insecure website development. This is just an example of using Flash to elaborate such an attack and to make it more successful. Adobe knows about this.
Again, all that is needed to make this kind of attack much less effective is to default the allowScriptAccess to “never”.

I guess Adobe don’t wont to break any more existing applications for the sake of security. Every change in the behavior of an existing feature cause some applications to break and frustration for their developers.

Every Flash Player release gets more secure, similar to the browsers and most platforms. Apparently this fix won’t get into the upcoming release of Flash 10 which already have its share of similar security updates, Maybe latter.

let me just clarify that CSRF flaws aren’t Flash related, it relate to insecure website development. This is just an example of using Flash to elaborate such an attack and to make it more successful.

]]> By: Infosec Update http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-287 Infosec Update Mon, 22 Sep 2008 11:37:06 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-287 This is some scary stuff. Have you spoken to Adobe about this? This is some scary stuff. Have you spoken to Adobe about this?

]]> By: CSRF attack through flash files http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-286 CSRF attack through flash files Fri, 19 Sep 2008 09:31:57 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-286 [...] came across this interesting blog by guya. He has also provided working PoC alongwith. A nice explanation of this attack [...] [...] came across this interesting blog by guya. He has also provided working PoC alongwith. A nice explanation of this attack [...]

]]> By: James http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-285 James Fri, 19 Sep 2008 00:03:57 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-285 Hi, I found your blog on this new directory of WordPress Blogs at blackhatbootcamp.com/listofwordpressblogs. I dont know how your blog came up, must have been a typo, i duno. Anyways, I just clicked it and here I am. Your blog looks good. Have a nice day. James. Hi, I found your blog on this new directory of WordPress Blogs at blackhatbootcamp.com/listofwordpressblogs. I dont know how your blog came up, must have been a typo, i duno. Anyways, I just clicked it and here I am. Your blog looks good. Have a nice day. James.

]]> By: guya http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-284 guya Thu, 18 Sep 2008 13:19:17 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-284 As long as the allowScriptAccess is defaulted to "sameDomain" and not to "never" this kind of attack will work. I havn't seen it's going to change in the upcoming Flash 10: http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html It'll work similarly on Flash Players 6, 7 when using the getURL('javascript:') and with Flash Players 8, 9, 10 with ExternalInterface.call As long as the allowScriptAccess is defaulted to “sameDomain” and not to “never” this kind of attack will work.

I havn’t seen it’s going to change in the upcoming Flash 10:
http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html

It’ll work similarly on Flash Players 6, 7 when using the getURL(‘javascript:’)
and with Flash Players 8, 9, 10 with ExternalInterface.call

]]> By: Joeflash http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/comment-page-1/#comment-283 Joeflash Wed, 17 Sep 2008 21:20:12 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-283 Specifically what version(s) of the Flash Player were you testing against? This information is crucial to a complete understanding of the issue, which may enable Adobe to issue a security patch. Specifically what version(s) of the Flash Player were you testing against? This information is crucial to a complete understanding of the issue, which may enable Adobe to issue a security patch.

]]>