Members
  • Total Members: 12816
  • Latest: t114563
Stats
  • Total Posts: 28524
  • Total Topics: 8240
  • Online Today: 993
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Serious web vuln found in 8 million Flash files (cross-site scripting attacks)  (Read 3228 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


A security researcher has identified more than 8 million Adobe Flash files that make the websites hosting them vulnerable to attacks that target visitors with malicious code.

The Flash files are contained on a wide variety of sites operated by online casinos, news organizations, banks, and professional sports teams. They make the pages where they reside susceptible to XSS, or cross-site scripting, attacks that have the potential to inject malicious code and content into a visitor's browser and in some cases steal credentials used to authenticate user accounts.

The researcher, who goes by the moniker MustLive, said the Flash files contain poorly written ActionScript used to count the number of times a banner has been clicked and typically contain the clickTAG or url parameters. Google searches here: http://www.google.com/search?hl=en&num=100&q=filetype%3Aswf+inurl%3AclickTAG&aq=f&oq=&aqi= and here: http://www.google.com/search?q=filetype%3Aswf+inurl%3Aurl identified a total more than 8.3 million of them on sites hosted by the New York Giants football team, Praguepost.com and ParadaisPoker.com. Because Google results are often abbreviated, the actual number is probably higher.

MustLive said websites that host the buggy content aren't automatically vulnerable to XSS exploits. Indeed, even though the pages on the official Citibank website included such content, XSS attacks that tried to exploit them failed: https://www.citibank.be/img/en/smd/loan_shortterm_dreams.swf?clickTAG=javascript:alert(%27XSS%27)

But the researcher provided a wealth of examples of websites that were made vulnerable by the Adobe files, which provide graphics that move and are often referred to as SWFs, because of the three-letter suffix their file names carry.

Examples of pages vulnerable to malicious code injection are here: http://server.cpmstar.com/cached/creatives/1499_728_90_games.swf?clickTAG=javascript:alert(%27XSS%27) , here: http://www.fatherhood.gov/assets/flash/nrfc_tictactoe_english_300x250.swf?clickTag=javascript:alert(%27XSS%27)  and here: http://www.wie-man-sieht.net/rod_web/_flash/World_CL.swf?url=javascript:alert(%27XSS%27)// . MustLive said this page can be exploited to reveal user cookies when accessed by virtually any browser: http://www.wie-man-sieht.net/rod_web/_flash/World_CL.swf?url=javascript:alert(document.cookie)//

Using the above Google searchers, El Reg was able to identify its own working exploits, including this one on the official website for the New York Giants. (In many cases, the scripts launch only after the user has clicked an object on the page): http://www.giants.com/uploads/temp/KSKTAIFQVXUDTUFXRWVS.swf?clickTAG=javascript:alert%28%27XSS%27%29

It's by no means the first time someone has identified a sprawling body of SWF files that threaten the security of the sites hosting them. Two years ago, researchers documented serious vulnerabilities in Adobe-based content that exposed more than 10,000 sites to attack.

The threat was particularly difficult to eradicate because webmasters had to patch their content-generation software and then render the animation scripts all over again. Months after the problem was identified, many websites still hadn't bothered to take action.

Last year, MustLive reported 215,000 vulnerable Flash files, a number he later raised to the millions. That content was also made vulnerable by buggy ActionScript: http://www.webappsec.org/lists/websecurity/archive/2008-11/msg00110.html

It should be said that the vulnerabilities exposed in the latest discovery are the result of bugs introduced by sloppy rendering, rather than vulnerable Adobe software. Adobe provides security guidance here: http://www.adobe.com/resources/richmedia/tracking/designers_guide/ for designing banners with tracking capabilities. MustLive provides additional advice at the end of his blog post documenting the vulnerable SWF files: http://websecurity.com.ua/3789/

(Register)

Samker's Computer Forum - SCforum.info





Fireberg

  • SCF Advanced Member
  • ***
  • Posts: 163
  • KARMA: 21
There are many Flash files out there that are vulnerable to this type of attack. There are thousands, and potentially hundreds of thousands of them, and they're all going to have to be rebuilt.

New technology comes many flaws too.

manual2100

  • SCF Member
  • **
  • Posts: 61
  • KARMA: 10
yea.. every site has flash because of the lame web designers..and advertisers. It was inevitable.. There are several ways to build a nice safe website..

hazedaze

  • SCF VIP Member
  • *****
  • Posts: 85
  • KARMA: 19
  • Gender: Male
As With any software package there will always be someone trying to find an exploit that provides back door access e.t.c, it does suprise me though of the sheer amount of wesites that STILL contain the flaw indentified. fairplay to the white hat for making the info public much respect amigo!!   :up:

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising