I saw this link on another board and thought it might be worth chatting about here. What I gather from the article the only way to ensure saome measure of safety here, other than not using flash, is to host any members uploaded images/files on another domain seperate from the main site. The I suppose they're pulled from that domain ala hotlinking. Is that correct? If so, I'd love to know how to do this OR is it really as bad/inevitable as they make it sound?

http://www.computerworld.com/s/article/9140768/Flash_flaw_puts_most_sites_users_at_risk_say_researchers

Thanks for posting this. I have, for many reasons (ask for a list ), been avoiding the use of Flash wherever possible for a while now. While it's a useful invention, it's often used in places where AJAX and a bit of javascripting would do.

The article is a bit ambiguous on how exactly the exploit happens. Flash exploits targeted from browser to the end-user's computer have been around for some time now --- and because you can stick just about anything into a flash object (and as others can't see the source) it makes it all the more easy, and because you can also embed Flash objects from third-party sites to a page, it's even more easy.

What I am concerned over is whether this can be employed for server-targeted attacks, for example by using the uploaded flash object to piggyback malicious code into public-writable folders on the server's file system. In fact, now that you mention, I have a couple of ideas how one might accomplish just that... I need to look into this a bit deeper, and consider a flash-freeze policy after I get to review the specifications for how these newly hyped exploits work.

If anyone finds links to articles that go into more technical detail on this, I'd appreciate if you shared them with me. I read through the more technical bit linked to from the article, but it still doesn't really get into sufficient detail to allow analyzing and addressing the issue.

I should probably implement an optional upload-domain-isolation into our next release as well. It was originally a part of the roadmap for when we begin working on clustered servers and high-end scalability, but I suppose this issue is serious enough to merit a change in plans. What say the public?

I assume that mean user uploads will be stored somewhere other than the main domain so as to minimize any possible attacks via flash. Then those files/images/vids etc will be drawn from there to the main domain page which is calling for them.

I vote yes

Yes exactly, that's what it means. =) It's something I have been meaning to do for a while at our own site here for general isolation purposes, so we might as well roll it out to everyone as an option.

would a sub-domain work well for this or is it advisable to have a whole seperate TLD? Will this slow the loading of the files to the main site?

From what I read, subdomains are also vulnerable, at least in some situations. I'll write more on this when I get a moment to study this in a bit more detail. This will also affect our entire setup here, and we do like to keep things as secure as possible (gateways and license database are already under a separate TLD and isolated), so rest assured we'll do our best to get it to the best possible shape.

Thanks again for posting this topic, and feel free to continue along the same lines! You and other members can set up blogs if you want (we'd welcome that very much), and open topics like this with good introductions, as you have done here.

it's a blog topic now

Should be interesting to see the outcome of this.