Home » News » Vulnerabilities » Adobes’s sandbox is not bulletproof

Adobes’s sandbox is not bulletproof

By Gina on January 7, 2011 | Vulnerabilities, Adobe's sandbox, how to break in Adobe's sandbox, Adobe's Flash Player Adobes’s sandbox is not bulletproof

Recently, Billy Rios, a Google security researcher, published a method of how he had broken in Adobe's sandbox which was created to prevent attacks of hackers.

Billy Rios explains his method of how he was able to bypass the local-with-file system sandbox in Adobe's Flash Player. Sandbox was designed to make harder for hackers to get users data to their systems.

Sandbox method supposedly has to lock so-called SWF files that can‘t be located by hackers. This is done by purpose to prevent private data to be sent to machines that belongs to cybercriminals.
The researcher found a work-around for these security measures. Apparently, there is a way to grab the information and send it to a remote server by combining GET protocol for local area networks and protocol handlers that do not require any additional approval. The experts used mhtml which is used on Windows.

Billy Rios explained method in details on his blog . However, Adobe spokeswoman called the breach a long shot in the response statement: “An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.“

More Vulnerabilities news

Windows 8 confronts malware

Windows 8 confronts malware

According to Bitdefender Win 8 OS isn't immune for 15% of the most popular malware online. This security firm has tested various widespread computer infections, trojans, worms and other malware and discovered that most of them can infect the latest Microsoft Windows OS. Chief security strategist Catalin Cosoi in Bitdefender commented: "As a means of protecting a computer from viruses, data theft and other type of malware, Windows Defender is better than nothing. Read more.


News categories

Latest news

Related news