Adobes’s sandbox is not bulletproof
By Gina on January 7, 2011 | Vulnerabilities, Adobe's sandbox, how to break in Adobe's sandbox, Adobe's Flash Player
Recently, Billy Rios, a Google security researcher, published a method of how he had broken in Adobe's sandbox which was created to prevent attacks of hackers.
Billy Rios explains his method of how he was able to bypass the local-with-file system sandbox in Adobe's Flash Player. Sandbox was designed to make harder for hackers to get users data to their systems.
Sandbox method supposedly has to lock so-called SWF files that can‘t be located by hackers. This is done by purpose to prevent private data to be sent to machines that belongs to cybercriminals.
The researcher found a work-around for these security measures. Apparently, there is a way to grab the information and send it to a remote server by combining GET protocol for local area networks and protocol handlers that do not require any additional approval. The experts used mhtml which is used on Windows.
Billy Rios explained method in details on his blog . However, Adobe spokeswoman called the breach a long shot in the response statement: “An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.“
More Vulnerabilities news
Shocking: 9 out of 10 websites still vulnerable to old attacks
Did you know that less than 10% of websites are safe from attacks that have struck the internet in 2009? Back then there was a breakout of Man-in-the-middle (MITH) attacks that included an injection of a malicious code in to the browser but even after 3 years these problems are very sensitive. SSL Pulse reportIt seems that companies live in a bubble as far as IT safety is concerned. A project called SSL Pulse that is monitoring 200. Read more.- Mozilla's decision: Firefox is blocked from running unpatched Java plugins
- Facebook still is a wonderland for cybercriminals
- Microsoft talks about dangerous flaw in a Windows
- 17 high-risk flaws are fixed in Chrome; Google pays $47,500 in bug bounties
- Google bypassed Safari's No Tracking settings
- Research reveals – 4/5 of security threats come from third-party software
- Google Wallet hack revealed
- Denial-of-service flaw is fixed by Oracle
- Firefox 9.0 and four critical flaws fixed
- Major flaw of Adobe Reader and Acrobat 9.x is patched
