The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
|
|||||||
|
#11
10-25-2003, 02:35 AM
|
|||
|
|||
i also find it kinda funny that every question similar to mine goes unanswered as well:
https://vborg.vbsupport.ru/showthrea...flash+security https://vborg.vbsupport.ru/showthrea...flash+security 
|
|
#12
10-25-2003, 05:12 AM
|
|||
|
|||
|
Quote:
Like Kura said any files coming from a 3rd party source can expose leaks. This is why the word javascript is spaced so it breaks any attempt's to execute a script or some bad code. Honestly I dont think it's wroth the tourble or resources to put in some kind of filter, if they need to post flash they can link to it, flash in threads is a bad idea if you have 56k'ers on site anyway. IMO
|
|
#13
10-25-2003, 05:31 AM
|
|||
|
|||
|
yea, i'm sure i want my users to post flash files, as long as it's secure. i'm gonna have a 10mbps line so the bandwidth doesn't really matter. ok, so what is the discerning difference between a remote flash file and a flash file on my own server? couldn't they just as easily upload a malicious .swf file onto my server, as they could on another server? or is there something i'm not getting?
|
|
#14
10-25-2003, 10:55 AM
|
||||
|
||||
|
Quote:
If you let users upload their own .swf files, you're 0% more secure than when you let them link to them. I'm sorry to disappoint you, but there is no way to have flash for your users without (fairly large) security risks. UNLESS... you want to do a lot of manual work: You Could have each user who wants to use flash, send you the .fla source file. Then you review the source file thoroughly to make sure there are no dangers in using it whatsoever. Then you compile it to a .swf and store that on your server, and THEN the user can use it. That will give you as much security against flash-abuse as far as your own flash skills go. If your flash skills are crap, you've still got security problems. If you're a flash master, you're likely to be safe.  Keep in mind though that any .swf that users give you can always be dangerous, cos you can't see the source anymore and you can't try every conceivable way of making malicious use of it. That would take a million lifetimes and then some, for each single .swf
|
|
#15
10-25-2003, 09:47 PM
|
|||
|
|||
|
ok, you keep telling me that it's not possible.. but if it weren't possible then i'm sure geocities/angelfire/xanga/every virtual host/etc wouldn't be allowing it.
what if every .swf file was uploaded to a certain directory, and it was restricted access to all other areas of the server except for that one directory? it wouldn't be too hard to disable the GET function for all files in that directory, either. so in that scenario, what could the flash file possibly do? it is unable to access any information or receive any information. all it does is play its movie. you keep telling me that it's a security risk, but i want to know why. i want to know the mechanics behind it.
|
|
#16
10-25-2003, 11:06 PM
|
||||
|
||||
|
As far as I know, those sites have spent many thousands of dollars on implementing very intricate security systems against this. Personally, I doubt they're really 100% secure (I've yet to be convinced on how you can verify the workings of a compiled object without being able to see the source) but in their case I reckon they're mostly just using systems that have virtually no execution power at all.
Do you know what a BOA server is? If so, that could give you an idea of how such sites are (most likely) set up. Scripts (ie. php scripts and the like) cannot be executed because there is no PHP installed, etc. etc. etc. By disabling a lot of such things you can dramatically limit what power any malicious file can have. For if a malicious file cannot execute any commands or anything, there's very little remaining that it can do. However, since you're running a vBulletin forum, likely on a shared or dedicated hosting, meaning a server with apache and mysql and php and god knows what else installed, you don't have that option. See the problem?
|
|
#17
10-26-2003, 12:32 AM
|
||||
|
||||
|
Take a look at this link http://eyeonsecurity.org/papers/flas...m#_Toc18055083
Which gives some examples of the risks that flash files can pose. That being said though, I would estimate that most flash developers wouldn't be able to do this or know how to but the risk is always there.
|
|
#18
10-26-2003, 12:50 AM
|
|||
|
|||
|
Which gives some examples of the risks that flash files can pose. That being said though, I would estimate that most flash developers wouldn't be able to do this or know how to but the risk is always there.[/QUOTE]
I'd like to summarize (without reading the above posts  ) that if you enable HTML or anything that supports scripting in posts/sigs/etc., you might as well shoot your forum in the head while you're at it. vB code is the safest you can get, and even then, custom vB codes can screw you over if you don't write them very carefully.
|
|
#19
10-27-2003, 09:43 PM
|
||||
|
||||
|
So There....
I stuck my big nose in this thread and what happened? Yeah you can guess it I got hacked (sort of) How did they do it? Since I am/was using a Shoutbox on my site which allowed html the person embedded a flash redirect into the box to redirect everyone who visited my site to an adult site. So there you go......This shows why any html is really sucky. Kinda thinking that they read this thread and did it just to prove a point....hmmmm.... Mike
|
 |
«
Previous Thread
|
Next Thread
»
| Thread Tools | |
| Display Modes | |
Linear Mode
|
|
All times are GMT. The time now is 03:50 AM.