Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Security Researcher Defeats Adobe Flash Sandbox

Flash expert Billy Rios bypassed Flash Player feature meant to prevent malicious attacks.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
A security feature added to harden Adobe Flash Player against attacks has been defeated.

Security researcher Billy Rios on Tuesday said that he's discovered "an easy way to bypass Flash's local-with-file system sandbox."

Adobe added the sandbox to Flash Player version 8. After facing heavy criticism for the number of security vulnerabilities present in Flash -- as well as Reader and Acrobat -- which attackers exploited heavily in 2010, Adobe also added a security sandboxes to Flash Player for Google Chrome, as well as for Reader X for Windows. The latter two applications' sandboxes weren't bypassed by Rios.

The Flash Player sandbox was meant to prevent SWF files, used by Flash, from reading local files or communicating with the network in any manner, thereby blocking many types of malicious attacks. According to Adobe documentation, the sandbox "assures the user that local data cannot be leaked out to the network or otherwise inappropriately shared."

But Rios labels that description "a bit too generous." While it's true that SWF files can't call JavaScript or make direct HTTP or HTTPS requests, they can make file requests to a remote server. Accordingly, an attacker -- or security researcher such as Rios, developing a proof of concept exploit -- can resort to a few tricks for sidestepping the sandbox restrictions to inappropriately share information.

In particular, Rios tapped the mhtml protocol handler that's built into Windows 7 and which will launch with no warning to the user. With mhtml, "it's easy to bypass the Flash sandbox," he said, and transmit data to a remote server without a user ever knowing that the exploit occurred.

What's notable with this vulnerability is that Rios wrote no attack code, but rather just used capabilities built into the Windows operating system to sidestep the sandbox.

"This is a flaw in design, it's not a flaw in implementation or coding," said Anup Ghosh, founder and chief scientist of Invincea, which develops browser and PDF sandboxes that use local, "throwaway" virtualized environments, rather than building a sandbox inside an application, as Adobe did.

"When you're writing a sandbox for an application, you have to think about every possible way that an attacker could hit you, and then design a block or Band-Aid for each of those techniques," said Ghosh. But Rios "basically exposed the fallacy of that thinking," because an attacker only has to find one communication protocol -- from one of thousands of libraries -- that isn't explicitly blocked.

Adobe acknowledged the vulnerability, rating it as "moderate," which hints at the potential difficulty of translating the vulnerability into a malicious exploit.

"An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively," according to a statement released by Adobe. "In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Can you smell me now?
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.