Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
Flash click-jacking exploit...
- https://isc.sans.edu...l?storyid=11857
Last Updated: 2011-10-21 - "... a blog post about a vulnerability in Flash that allows for a click jacking attack to turn on the clients camera and microphone. The attack is conceptually similar to the original click jacking attack presented in 2008. Back then Flash adjusted the control panel. The original attack "framed" the entire Flash control page. To prevent the attack, Adobe added frame busting code to the settings page. Feross' attack doesn't frame the entire page, but instead includes just the SWF file used to adjust the settings, bypassing the frame busting javascript in the process.
Update: Adobe fixed the problem. The fix does not require any patches for client side code. Instead, adobe modified the control page and applet that users load from Adobe's servers. Details from Adobe:
- http://blogs.adobe.c...gs-manager.html
"... We have resolved the issue with a change to the Flash Player Settings Manager SWF file hosted on the Adobe website..."
> http://www.macromedi..._manager06.html
___
- http://blogs.adobe.c...nd-acrobat.html
October 21, 2011 - "The next quarterly security update for Adobe Reader and Acrobat has been rescheduled for January 10, 2012."
Edited by AplusWebMaster, 23 October 2011 - 03:59 PM.
