New Attack Technology Using Flash parameter Injection

Www.2cto.com: this is an old article:

This article will introduce the new attack technology that uses Flash parameter injection. The most important thing is that this technology can cause permanent attacks. In view of the fact that the conventional defense mechanism used by Web applications is not enough to defend against such attacks, it is expected to attract the high attention of Web developers. At last, this article provides related security suggestions.

I. Summary

This article will introduce you to a new type of attack, known as FPI, that is, Flash parameter injection attacks. Previously, security experts discovered that if attackers can access and control the global parameters of Flash, they can complete such operations as cross-site scripting attacks through Flash, cross-site flash, and modifying the stream of Flash videos. These attacks require direct access to Flash videos and URI-based parameter settings. When a Flash video is embedded in an HTML page and cannot access the original DOM, attackers cannot launch these attacks.

In many cases, Flash files can only be run in the original HTML, but cannot be loaded as Uris. In this way, conventional cross-site flash attacks cannot be carried out. This article demonstrates some techniques that can be used by attackers to inject global Flash parameters when a movie is embedded into an original HTML page. These injection parameters not only give attackers full control over the page DOM, but also control other objects in the Flash video. This can use the interaction between Flash videos and their HTML pages to launch more well-planned attacks. Therefore, the FPI technology described in this article can increase the adaptability of Flash attacks, that is, there will be more websites facing the danger of Flash attacks.

In this article, we will discuss five different technologies. First, we will describe a simple DOM-based injection technology that allows attackers to inject Flash parameters using the URI of the original HTML page, this avoids detection by IDS of Web servers and IPS protection mechanisms. This example shows that the encodeURI function that is often used for URI disinfection is insufficient to combat this attack. The second technique uses HTML forms or URI parameters to inject global Flash parameters. The third technique demonstrates how to overwrite the values of these parameters by referencing Flash videos. The fourth technology shows you how to use the attributes of html object tags to implement FPI. Finally, the fifth technology provides you with a persistent Flash parameter injection attack method. This technology makes the injected content persistent data, which means that the injected content is still valid even after the security vulnerabilities that allow injection are fixed in different sessions. In fact, some technologies involved in this article have been widely applied to various applications in reality.

Ii. Background Knowledge

Adobe Flash is widely used to provide vivid and interactive elements for Web pages. Flash videos can be embedded into HTML pages and played in independent Flash Player.
Flash videos can contain simple scripts, which are usually written in the ActionScript language. These scripts are used to enhance the performance of Flash videos, create more dynamic Web pages, and more diverse Internet applications.

1. embed a Flash video in HTML

You can embed a Flash video in an HTML page in the following ways:

 

Figure 1 embedded Flash in HTML
When you access this page, the browser automatically downloads the Flash video and plays it for you on this page. When embedded into an HTML page, the Flash video has the permission to access the DOM of the page, which means that JavaScript code can be executed through the ActionScript code of the movie. Because a movie can access the entire DOM, the movie can also access the Cookie set for the user's computer by loading the Flash domain.

When a Flash video is embedded into an HTML page, another method is available, that is, when a user browses the URL of the Flash video, the Flash video is directly embedded into the page by the browser. In this case, a ghost HTML page is created, which stores the Flash video as an embedded object, as shown below:

 
Figure 2 Specify the HTML of Flash
Note: In this case, because the original Flash video is embedded into an HTML page, the Flash video continues to be embedded into the preceding HTML page, therefore, the DOM of the preceding HTML page cannot be accessed. 2. Pass parameters to the Flash video

There are multiple ways to pass parameters from an embedded object to a Flash video. Each parameter passed to a movie can be used as a global variable under the _ root object of the video clip in the Flash video. The following is an example of how to use the ActionScript2 code with the global parameter ":

 


Figure 3 sample code for reading global variables
This is a very common piece of code in Flash videos. Attackers can use this code to perform cross-site scripting, cross-site flash attacks, and other types of attacks. Below we will introduce three different methods to use the code.

Method 1: direct reference

The first way to pass parameters is to directly give the Flash file address and then pass parameters in the URI itself, which is very similar to passing HTTP parameters through GET. For example, you can use direct reference to pass parameters as follows:

Http://www.bkjia.com/myMovie.swf? A = 5 & B = hello

In this example, two parameters are transmitted to the Flash file. The first parameter is "a" and its value is "5". The second parameter is "B" and its value is "hello ". When using this method, the Flash file is not embedded into the original HTML page, but is embedded into the automatically generated "ghost" HTML page.

Method 2: Embed URI

The second method is to use the URI of the embedded object to pass parameters. For example:

 

Figure 4 passing parameters using an embedded URI
In this case, the Flash file is still embedded into the original HTML page.

Method 3: Use the "flashvars" attribute

The third method requires the "flashvars" attribute, which can be specified in the "OBJECT" tag or as the "parameter" tag. The following is an example of an embedded Flash file that can receive parameters embedded in an HTML page:

 

Figure 5 passing Parameters Using "flashvars"
Like the previous method, this method can be used to pass parameters to Flash videos embedded in an HTML page. As mentioned at the beginning of this article, it is known that the method used to overwrite the global Flash parameters is only to directly access the Flash video and pass the parameters through the URI, that is, the first method shown in this article. This attack method cannot access the DOM of the original HTML page (that is, the page embedded in Flash), so it imposes restrictions on the attack scope.

Iii. New Attack Technologies

Next we will introduce a new method that can be used to override the value of the global Flash parameter, even if the Flash video is embedded in the original HTML page, you can still access the DOM of the page. We will demonstrate some techniques for completing Flash parameter injection attacks. First, we will start with some simple technologies. You will see that disinfection functions such as "encodeURI" do not provide necessary protection. Later, we will introduce a persistent Flash parameter injection attack technology. This method can not only infect Flash files, but also triggers Flash parameter injection every time you play a Flash video. Persistent FPI can cause victims to be attacked every time they view vulnerable Flash files. Even if the security vulnerability of the Flash file has been modified, the victim is still affected by the attack.

DOM-based Flash parameter Injection

When the "document. location" variable is used as part of the Flash parameter, FPI can be implemented in this form. The following is a snippet of the vulnerable HTML file:

 

Figure 6 JavaScript code used to create a Flash Object

When you use this webpage normally, the above JavaScript code will generate the following HTML page:

 

Figure 7 HTML generated by JavaScript code
In this case, the developer of the HTML page passes the URL of the page to the Flash file in the global parameter "location. After realizing the security of Web applications, developers use the "encodeURI" function to avoid attacks such as DOM-based cross-site scripting.

Despite the caution of developers, attackers can trick unwary victims into clicking the following link:

Http://www.bkjia.com/index.htm # & globalVar = e-v-I-l

After you click the preceding link, the following HTML page is displayed:

 

Figure 8 HTML caused by attacks
At this time, two variables are sent to the Flash file. The first variable is "location" and its value is "http://www.bkjia.com/index/htm #"; the second variable is "globalVar ", the value is "e-v-I-l ". This means that attackers can control all global Flash variables of Flash files embedded in the original HTML page.

In fact, using "?" If you replace "#", it will also lead to the same attack. However, the advantage of using a pound sign (#) is that the subsequent data is not sent to the server, so that IDS or IPS on the attacked site cannot detect the attack.

This attack is successful because the JavaScript function "encodeURI" does not encode all characters, such as "&" and "?". . Although this function is widely used to prevent DOM-based cross-site scripting attacks, it cannot prevent DOM-based Flash parameter injection attacks. In this case, disinfection measures should be taken according to the specific situation, such as using functions such as "escape" or "encodeURIComponent" to inject reflective Flash parameters.

When the Flash video name is exposed as a form or URL parameter, the application is vulnerable to Flash parameter injection attacks. Attackers can control the mounted Flash video to load a malicious Flash video, even if protective measures have been taken, such as allowing only legitimate movies to be loaded from a specific domain, however, specifying Flash makes it easier to overwrite the global parameters of the Flash video embedded in the HTML page. For example, the following is a Perl script on a Web server. "params" is an associated array that stores all relevant HTML parameters:

 



Figure 9 Create HTML code with dynamic Flash video
In the code above, the name of the Flash video is taken from the form or URL parameter in the request and placed as the name of the Flash video to be loaded into the generated HTML page. Attackers can create an aggressive link as follows to overwrite some global Flash parameters:

Http://www.bkjia.com/index. cgi? Moview.mymovie.swf? GlobalVar = e-v-I-l

Note that the video name contains a question mark, which is the parameters that will be passed to the Flash file. When a victim clicks this link, the following HTML code is generated and sent to the victim:

 
 

 

Figure 10 HTML with Injection Parameters generated by CGI scripts
The browser loads the embedded Flash file based on the additional global parameters provided by the attacker. To control multiple parameters at a time, attackers need to separate these parameters using the URI-encoded ampersand. Below is a malicious link used to inject multiple parameters at a time:

Http://www.bkjia.com/index. cgi? Moview.mymovie.swf? GlobalVar = e-v-I-l % 26 otherVar = B-a-d

Although Web application developers ensure that the film name is loaded from a specific domain, there is still a Flash parameter injection attack security vulnerability.

Another method for implementing this attack is to control the name of the loaded Flash video in another Flash video. The following is an ActionScript2 sample code that is vulnerable to such attacks. This code loads a Flash file into an existing Flash file:

 
Figure 11 ActionScript code used to load internal Flash files
If you use the following aggressive links to load Flash files:

Http://www.bkjia.com/myMovie.swf? Moviename=internalMovie.swf? GlobalVar = e-v-I-l

You can set the global parameter "globalVar" to "e-v-I-l" to load the Internal Flash file.

⒊ Reflection-type Flash parameter injection attack (with FlashVars)

When one or more parameters are transmitted using the "flashvars" attribute from Unsanitized HTML parameters, FPI attacks may be initiated through HTML parameters. Let's assume that a CGI script written in Perl on the server contains the following code (associated array params stores all parameters passed to the page ):

 

 

 

Figure 12 create the Perl CGI code of HTML with a Flash Object

If attackers can try to have the victim click the following malicious link:

Http://www.bkjia.com/index. cgi? Language = English % 26 globalVar = e-v-I-l

"% 26" in the above link will be encoded into an ampersand (&), resulting in the following HTML code:

 
Figure 13 HTML generated by CGI code with an additional parameter
Today, attackers have controlled all global Flash variables embedded in the Flash file on the original HTML page. If the parameter is passed to the Flash video in the embedded URI (that is, the second method of passing the parameter to the Flash file), this attack can also be completed.

4. Flashvars Injection Attack

In some cases, some attributes of the "OBJECT" tag are received as parameters. For example, the width and height of a Flash video can be dynamically created using the CGI script written in Perl ("params" is an associated array that stores all HTML parameters ):

 
Figure 14 create a Perl-CGI script for a Flash object with a dynamic width and height
In this example, Parameters "width" and "height" are directly transmitted to the output HTML file without strict disinfection. Attackers can try to allow uninformed victims to click the following aggressive link:

Http://www.bkjia.com/myMovie. cgi? Width = 600 & height = 600% 22% 20 flashvars = % 22 globalVar = e-v-I-l

The URL will be encoded:

Http://www.bkjia.com/myMovie. cgi? Width = 600 & height = 600 "flashvars =" globalVar = e-v-I-l

Clicking this link will send the following HTML page to the client browser:

 
Figure 15 HTML generated by CGI script
In this way, the creator of the web page can inject the "flashvars" attribute into the "OBJECT" tag without passing parameters to the Flash file. ⒌ Persistent Flash parameter Injection Attack

The shared local Flash Object, known as the Flash Cookie, allows the Flash video to be stored for subsequent sessions. The data in the shared object can be saved and loaded into the Flash video. The following is an example of saving data in a shared Flash Object:

 
Figure 16 data stored in a shared object
The following is an example of loading data from a shared object:

 
Figure 17 load data from a shared object
If the shared object is saved as a user input and subsequently inserted into a potentially dangerous local function, a persistent Flash parameter injection attack may occur. When a Flash video is loaded, malicious Code is injected into the Flash file and executed. The following is an example of code that is vulnerable to persistent Flash parameter injection attacks:

 

 

 

Figure 18 Flash files vulnerable to persistent FPI attacks
In this Flash file, if the global variable "_ root. flashfile is set to undefined, so its value is not set by reading data stored in a shared object (if any), or by a default value. This value is then stored in a shared object and used as a parameter of the potentially dangerous local function "getURL.

If a user who does not have any doubts about this attempt clicks the following malicious link in the deception of an attacker:

Http://www.bkjia.com/vulnerable.swf? Flashfile = javascript: alert (document. domain)

The consequence is not that when the victim's browser executes the JavaScript code shown once in the context of the Flash file with vulnerabilities, but every time the Flash file is loaded, this JavaScript script will be executed again whether it is referenced directly or embedded into the domain. A tracing device deployed on a vulnerable site, such as IDS or IPS, can only detect infections, but cannot identify the cause, or even make them unaware of the occurrence. Subsequent requests to the site will be completely normal, but the victim's browser will still suffer this attack.
The attack range of the previous Flash attacks and the change into persistent attacks.

In this way, a savvy attacker can launch an attack only when Flash is embedded into the HTML page. The first execution is used to infect the victim. Then, each time the code is executed, it will check whether Flash is embedded into the correct HTML page, and then start the offensive.

The biggest impact of this attack is its persistence. Even if the code is installed with a patch to prevent the injection of parameter values in the future, the original injected value will still exist in the shared object indefinitely, therefore, each time the Flash file is loaded, the attack will occur again.

Iv. Impact of new attacks

The various technologies described in this article have the primary advantage of being able to attack Flash videos embedded in the original HTML page, therefore, the interaction between Flash files and parent pages can be used to achieve more sophisticated attacks. Even if the creator of a Flash video cannot run the Flash file outside the original HTML page, these attacks still work.

5. Security suggestions

When embedding Flash videos on a Web page, Web application developers must sanitize the input carefully. Developers must realize that the JavaScript function "encodeURI" cannot thoroughly sanitize the input for the global Flash parameter. A special disinfection method should be used for this. Of course, it would be best if there is a security model that can accurately describe which characters are acceptable input, because the whitelist is relatively safe.

Web applications that are vulnerable to DOM-based FPI attacks cannot assume that their clients are not under attack, even if security mechanisms such as IPS or IDS monitor traffic, because the attack segment (part after URI #] is not sent to the Web server by the browser, the Web server cannot detect the attack.

Flash video developers must be aware that storing received information as global parameters in Local Shared Objects will cause persistent Flash parameter injection attacks. Flash videos that are vulnerable to persistent FPI attacks will always be affected by Flash attacks that overwrite global parameters. These attacks include cross-site scripting attacks and cross-site flash attacks. Even after the FPI security vulnerability is fixed. In this case, you must fix the Flash File Vulnerability and re-compile it, and change the name of the local shared object to completely solve the problem.

Vi. Summary

This article will introduce the new attack technology injected with Flash parameters. The most important thing is that this technology can cause permanent attacks. In view of the fact that the conventional defense mechanism used by Web applications is not enough to defend against such attacks, it is expected to attract the high attention of Web developers. At last, this article provides relevant security suggestions.

BKJIA exclusive Article