Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Flash Security
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
phishintrip007
n00b
n00b


Joined: 04 Dec 2012
Posts: 2
Location: Pensacola, FL

PostPosted: Tue Dec 04, 2012 12:05 pm    Post subject: Flash Security Reply with quote

I have a question about Adobe Flash and security. I want to use adobe flash because Gnash and swfdec don't seem to work on a lot of sites but I am concerned over the security warning. What exactly is the security issue? Is it within the adobe flash package itself or is it a gentoo specific issue? Is there a way to still use adobe flash and isolate it from anything else critical/personal/confidential on my machine or is it one or the other?
Back to top
View user's profile Send private message
ChrisJumper
Veteran
Veteran


Joined: 12 Mar 2005
Posts: 1817
Location: Germany

PostPosted: Tue Dec 04, 2012 8:13 pm    Post subject: Reply with quote

Hi phishintrip007!

Lets talk about it. Adobe Flash is a grow old, piece of Software. I don't take a look at code myself but read and hear about people that worked on it or wrote exploits. Adobe Flash have major bugs -by design-, one is that it try to support old versions/formats/standards. To run nearly everything that was developed and supported by flash from 1992 up to today.

It also implements some codecs for sound, images and video formates about the years. And that make it so dangerous to use it.

Its just a question about time to find a new exploit. Mostly the exploits grants user access on your machine, which execute the browser that run the flash-plugin. From the users point of view its easy to go ahead, attack your Sound or Videocard-driver.

Thats why it is so dangerous. So use a flashblock addon to deactivate flashcode, that you don't need. For it you will get an Play-Symbol on youtube for example that you have to click before you start that code. Its also nice to deactivate some advertising banner.

This is the true reason why apple and others will not have flash on there systems, sometimes its about jail breaking too. If you have your own squit-proxy Server you could take a look at the blitzableiter project Blitz is the german word for flash and blitzableiter is a lightning rod or lightning conductor.

I see now that this project supports some plugins for firefox too. It go some steps further and try to analyse the implemented flash object's for "bad stuff". As far as i memorize its not a black white list like virus scanners... oh just read this from the wikipage:

Quote:
The Blitzableiter is a defensive solution for Adobe Flash Rich Internet Applications. It realizes the protection by applying a process of normalization through recreation.

Blitzableiter protects against attacks using Adobe Flash application files in SWF format. It can prevent attacks targeted at exploiting memory corruption vulnerabilities in the runtime environment as well as attacks using the runtime environment's native functionality maliciously.

Section 2 will give an overview of the general approach and the Flash file format. Section 3 provides information about the code structure and organization. Section 4 gives advise on how to test and debug the library.


Quote:
Is there a way to still use adobe flash and isolate it from anything else critical/personal/confidential on my machine or is it one or the other?


You will never get 100% safety. So no. But.. i use it too, til HTML5 will be reach our present.

Good guy say: Oh you could use this flash object cause this website is serious.
Bad guy thinks: Cause they don't know that i got access (or a man in the middle) and exchange there flash objects.

Every reduce of flash objects in your internet enjoyment make your computers integrity for you saver.

Hope i could help you.

Chris
Back to top
View user's profile Send private message
cach0rr0
Moderator
Moderator


Joined: 13 Nov 2008
Posts: 4122
Location: Houston, Republic of Texas

PostPosted: Wed Dec 05, 2012 4:42 am    Post subject: Reply with quote

an alternative to a separate plugin - for chromium at least, there is a "Click to Play" feature you can enable
it basically functions the same way as flashblock
and can be used for things like java as well
_________________
Lost configuring your system?
dump lspci -n here | see Pappy's guide | Link Stash
Back to top
View user's profile Send private message
phishintrip007
n00b
n00b


Joined: 04 Dec 2012
Posts: 2
Location: Pensacola, FL

PostPosted: Wed Dec 05, 2012 9:47 am    Post subject: Reply with quote

Thanks for the response guys! I really like that flashblock plugin for several reasons, mostly blocking the flash i dont want to see (ads). I know you can't protect people from themselves so I am fine with it allowing me to play whatever I click on and blocking everything else. I just don't want the browser autorunning everything.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum