How are sites like xanga.com able to enable HTML and flash?
 

...without having their site hacked?

they filter out all potentially harmful HTML and flash via intricate filtering. These sort of filters are usually custommade by some company or so for them, and cost a good penny.

And just because you have not seen them hacked doesn't mean they haven't been - or won't be in the future.

ok, i know xanga has been hacked but i was just wondering how safe velocd's custompage hack is. i'm ok with disabling javascript, but how exactly can you hack a site through flash? does anyone know of any resources i can read on this?

thanks! :)

it would also be nice to read some stuff on how javascript can hack a vbulletin (if html is enabled) but i'm not too optimistic about the possibility of leaving that on, hehe. it would just be nice to know, for curiosity's sake.

btw i'm ok at php/mysql so you can use programmer-geek language to explain it to me ;)

See, I don't think it's really good for anyone to tell you how to hack a vBulletin. Such information can easily be abused, perhaps not by you but by others. Moreover, we have no way of making sure you won't abuse that knowledge yourself.

Same with hacking through Flash.

ok, i assure you, all i want to do.. is install velocd's custompage hack while maintaining the peace of mind that no one's going to destroy my site through it. in its current form, it does allow you to embed flash into the html code of a member's page, which is exactly why i want to know how much i can limit this to keep my server secure. deterrence through obscurity never works, which is why open-source products are more secure than microsoft products. i think it would be beneficial to the entire vbulletin.org community, if we knew the vulnerabilites in our software,.. so if anyone would be kind enough to tell me exactly how flash can be used to hack the server, i'd really appreciate it.

trust me, allowing users to embed flash on your site from whatever given source is a major security leak. There is no way you can make it safe, the only safe way is to not allow flash, simple as that. Or to let them choose from a few examples that you both store and have made, all by yourself. But that's probably not what you want...

yes, i trust you in that it is a security leak, but as a programmer, i have a proclivity to understand why things work the way they do.

some forums use the following method to embed flash:

are you telling me that all these forums (assuming that they are publicly accessible) are insecure as well?

with all due respect, i find your unwillingness to relinquish any information on this matter rather unnerving.. i have never, and will never, hack someone else's vbulletin. i just have a desire to know why it's possible, to better my understanding of the security threats to my website, and to better my understanding of website security in general. i was under the impression that this is a trait common to all programmers, is it not?

from the way you're talking, it seems like you're pretty knowledgeable about this stuff, so i'm sorry if we misunderstood each other along the way, but i'd really appreciate it if you would help me out here, or at least guide me towards some information on the nature of malevolent flash scripts.

well, I'm just hesitant in sharing information about security leaks / loopholes etc.
other people read this site, too. they might have real bad intentions....


Basically, embedding any flash file from a source that is not your own server, poses a direct thread. There is no way of telling what the flash file will do upon execution, and flash files are capable of a lot more than people think.... So yes, the vB Code above is a risk, a security problem...

ah i see, so the only thing i need to do is filter it so that the flash file must come from my own server? so i can have them upload the .swf file to my server, and link to it in the embed tag?

i also find it kinda funny that every question similar to mine goes unanswered as well:


https://vborg.vbsupport.ru/showthrea...flash+security
https://vborg.vbsupport.ru/showthrea...flash+security

Thats one way, but do you really want to be hosting tons of .swf files on your servers. Ask yourself, do your members really need to post flash files?.

Like Kura said any files coming from a 3rd party source can expose leaks. This is why the word javascript is spaced so it breaks any attempt's to execute a script or some bad code.

Honestly I dont think it's wroth the tourble or resources to put in some kind of filter, if they need to post flash they can link to it, flash in threads is a bad idea if you have 56k'ers on site anyway. IMO

yea, i'm sure i want my users to post flash files, as long as it's secure. i'm gonna have a 10mbps line so the bandwidth doesn't really matter. ok, so what is the discerning difference between a remote flash file and a flash file on my own server? couldn't they just as easily upload a malicious .swf file onto my server, as they could on another server? or is there something i'm not getting?

No, that would be essentially just as dangerous. The only real difference between having flash files on your server that they can use, and remote flash files that they can use, is that you can delete risky .swf files from your server.

If you let users upload their own .swf files, you're 0% more secure than when you let them link to them.


I'm sorry to disappoint you, but there is no way to have flash for your users without (fairly large) security risks. UNLESS... you want to do a lot of manual work:

You Could have each user who wants to use flash, send you the .fla source file. Then you review the source file thoroughly to make sure there are no dangers in using it whatsoever. Then you compile it to a .swf and store that on your server, and THEN the user can use it.

That will give you as much security against flash-abuse as far as your own flash skills go. If your flash skills are crap, you've still got security problems. If you're a flash master, you're likely to be safe. :)

Keep in mind though that any .swf that users give you can always be dangerous, cos you can't see the source anymore and you can't try every conceivable way of making malicious use of it. That would take a million lifetimes and then some, for each single .swf :)

ok, you keep telling me that it's not possible.. but if it weren't possible then i'm sure geocities/angelfire/xanga/every virtual host/etc wouldn't be allowing it.

what if every .swf file was uploaded to a certain directory, and it was restricted access to all other areas of the server except for that one directory? it wouldn't be too hard to disable the GET function for all files in that directory, either.

so in that scenario, what could the flash file possibly do? it is unable to access any information or receive any information. all it does is play its movie.

you keep telling me that it's a security risk, but i want to know why. i want to know the mechanics behind it.

As far as I know, those sites have spent many thousands of dollars on implementing very intricate security systems against this. Personally, I doubt they're really 100% secure (I've yet to be convinced on how you can verify the workings of a compiled object without being able to see the source) but in their case I reckon they're mostly just using systems that have virtually no execution power at all.

Do you know what a BOA server is? If so, that could give you an idea of how such sites are (most likely) set up. Scripts (ie. php scripts and the like) cannot be executed because there is no PHP installed, etc. etc. etc.
By disabling a lot of such things you can dramatically limit what power any malicious file can have. For if a malicious file cannot execute any commands or anything, there's very little remaining that it can do.
However, since you're running a vBulletin forum, likely on a shared or dedicated hosting, meaning a server with apache and mysql and php and god knows what else installed, you don't have that option.

See the problem? :)

Take a look at this link http://eyeonsecurity.org/papers/flas...m#_Toc18055083

Which gives some examples of the risks that flash files can pose. That being said though, I would estimate that most flash developers wouldn't be able to do this or know how to but the risk is always there.

Which gives some examples of the risks that flash files can pose. That being said though, I would estimate that most flash developers wouldn't be able to do this or know how to but the risk is always there.[/QUOTE]
I'd like to summarize (without reading the above posts ;)) that if you enable HTML or anything that supports scripting in posts/sigs/etc., you might as well shoot your forum in the head while you're at it. vB code is the safest you can get, and even then, custom vB codes can screw you over if you don't write them very carefully.

So There....

I stuck my big nose in this thread and what happened? Yeah you can guess it I got hacked (sort of)

How did they do it?

Since I am/was using a Shoutbox on my site which allowed html the person embedded a flash redirect into the box to redirect everyone who visited my site to an adult site.

So there you go......This shows why any html is really sucky.


Kinda thinking that they read this thread and did it just to prove a point....hmmmm....

Mike