Port scanning with Adobe Flash
The same origin policy for web browsers is completely blown. Last year SPI Dynamics demonstrated how to trick a browser into doing a port scan of the local network using plain old Javascript. Now researchers at the Chaos Communication Camp demonstrated that Adobe Flash can do the same thing. Very neat proof of concept.
Yet another reason not to trust Flash content and to run host-based firewalls on your intranet workstations and servers. With flaws like these and problems like DNS rebinding , code executed in browsers are no longer limited to accessing their origin server. We can retire the outdated concept of network perimeter.
It’s not practical to disable Flash, but if you use Firefox or another Mozilla browser, the FlashBlock extension at least lets you decide which Flash content your browser can execute.
Related posts:
- Major new flaw in Adobe Flash Player – Windows, Linux and Mac
- Remote exploit in Adobe Flash player
- Disarming Adobe PDF Viewer
Tags: adobe flash security, browser security, Malware, port scanning, vulnerabilities
One Response to “Port scanning with Adobe Flash”:
October 29th, 2008 at 7:54 am
[...] Port scanning with Adobe Flash [...]