Comments on: Encapsulating CSRF attacks inside massively distributed Flash movies – Real world example http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/?utm_source=rss&utm_medium=rss&utm_campaign=encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example Flash and Everything Else Sun, 11 Dec 2011 07:35:16 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: restaurant lille http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-329 restaurant lille Fri, 25 Mar 2011 00:34:26 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-329 hmm nice article thank you for sharing her give my appetite want to read again and again ^ ^ my restaurant>> <a href="http://restaurant.lille.free.fr" rel="nofollow">restaurant lille</a> hmm nice article thank you for sharing her give my appetite want to read again and again ^ ^ my restaurant>> restaurant lille

]]> By: making up http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-328 making up Wed, 16 Mar 2011 05:10:36 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-328 Need to find more insight the the mind of the ex-girlfriend I think. Anyhow well done. Need to find more insight the the mind of the ex-girlfriend I think. Anyhow well done.

]]> By: making up http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-327 making up Wed, 16 Mar 2011 05:10:02 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-327 Is getting back with the ex-wife wise? What made you leave is still there. Is getting back with the ex-wife wise? What made you leave is still there.

]]> By: ex-girlfriend http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-326 ex-girlfriend Wed, 16 Mar 2011 05:09:39 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-326 Well done. I agree mostly with what you say. I think people go about making up because of always only remembering the good times. Well done. I agree mostly with what you say. I think people go about making up because of always only remembering the good times.

]]> By: jobs in graphic design http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-325 jobs in graphic design Thu, 17 Feb 2011 16:16:42 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-325 I unquestionably accept as true with what you have stated. In reality, I browsed through your additional content articles and I do believe you are completely correct. Great job with this particular site. I unquestionably accept as true with what you have stated. In reality, I browsed through your additional content articles and I do believe you are completely correct. Great job with this particular site.

]]> By: String http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-324 String Thu, 20 Jan 2011 13:29:42 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-324 Great article! This is a really good blog! Thank you! You'll find more informations on <a href="http://www.lingerie-de-charme.net" rel="nofollow">Lingerie de charme</a>. There's everything that you need! Great article! This is a really good blog! Thank you! You’ll find more informations on Lingerie de charme. There’s everything that you need!

]]> By: Making Money » Blog Archive » What are ways of making money for copyright and having a website? http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-323 Making Money » Blog Archive » What are ways of making money for copyright and having a website? Tue, 25 Nov 2008 19:59:30 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-323 [...] GUYA.NET » Blog Archive » Encapsulating CSRF attacks inside … [...] [...] GUYA.NET » Blog Archive » Encapsulating CSRF attacks inside … [...]

]]> By: guya http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-322 guya Mon, 22 Sep 2008 13:23:50 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-322 Adobe knows about this. Again, all that is needed to make this kind of attack much less effective is to default the allowScriptAccess to "never". I guess Adobe don't wont to break any more existing applications for the sake of security. Every change in the behavior of an existing feature cause some applications to break and frustration for their developers. Every Flash Player release gets more secure, similar to the browsers and most platforms. Apparently this fix won't get into the upcoming release of Flash 10 which already have its share of similar security updates, Maybe latter. let me just clarify that CSRF flaws aren't Flash related, it relate to insecure website development. This is just an example of using Flash to elaborate such an attack and to make it more successful. Adobe knows about this.
Again, all that is needed to make this kind of attack much less effective is to default the allowScriptAccess to “never”.

I guess Adobe don’t wont to break any more existing applications for the sake of security. Every change in the behavior of an existing feature cause some applications to break and frustration for their developers.

Every Flash Player release gets more secure, similar to the browsers and most platforms. Apparently this fix won’t get into the upcoming release of Flash 10 which already have its share of similar security updates, Maybe latter.

let me just clarify that CSRF flaws aren’t Flash related, it relate to insecure website development. This is just an example of using Flash to elaborate such an attack and to make it more successful.

]]> By: Infosec Update http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-321 Infosec Update Mon, 22 Sep 2008 11:37:06 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-321 This is some scary stuff. Have you spoken to Adobe about this? This is some scary stuff. Have you spoken to Adobe about this?

]]> By: CSRF attack through flash files http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-320 CSRF attack through flash files Fri, 19 Sep 2008 09:31:57 +0000 http://blog.guya.net/2008/09/14/encapsulating-csrf-attacks-inside-massively-distributed-flash-movies-real-world-example/#comment-320 [...] came across this interesting blog by guya. He has also provided working PoC alongwith. A nice explanation of this attack [...] [...] came across this interesting blog by guya. He has also provided working PoC alongwith. A nice explanation of this attack [...]

]]>