Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 General Discussions

Reply
 
Thread Tools Display Modes
  #11  
Old 10-25-2003, 02:35 AM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

i also find it kinda funny that every question similar to mine goes unanswered as well:


https://vborg.vbsupport.ru/showthrea...flash+security
https://vborg.vbsupport.ru/showthrea...flash+security
Reply With Quote
  #12  
Old 10-25-2003, 05:12 AM
Brad Brad is offline
 
Join Date: Nov 2001
Posts: 4,765
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Tae-Hwan
ah i see, so the only thing i need to do is filter it so that the flash file must come from my own server? so i can have them upload the .swf file to my server, and link to it in the embed tag?
Thats one way, but do you really want to be hosting tons of .swf files on your servers. Ask yourself, do your members really need to post flash files?.

Like Kura said any files coming from a 3rd party source can expose leaks. This is why the word javascript is spaced so it breaks any attempt's to execute a script or some bad code.

Honestly I dont think it's wroth the tourble or resources to put in some kind of filter, if they need to post flash they can link to it, flash in threads is a bad idea if you have 56k'ers on site anyway. IMO
Reply With Quote
  #13  
Old 10-25-2003, 05:31 AM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

yea, i'm sure i want my users to post flash files, as long as it's secure. i'm gonna have a 10mbps line so the bandwidth doesn't really matter. ok, so what is the discerning difference between a remote flash file and a flash file on my own server? couldn't they just as easily upload a malicious .swf file onto my server, as they could on another server? or is there something i'm not getting?
Reply With Quote
  #14  
Old 10-25-2003, 10:55 AM
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Oct 2001
Location: inside vB3's .php
Posts: 1,245
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Tae-Hwan
ah i see, so the only thing i need to do is filter it so that the flash file must come from my own server? so i can have them upload the .swf file to my server, and link to it in the embed tag?
No, that would be essentially just as dangerous. The only real difference between having flash files on your server that they can use, and remote flash files that they can use, is that you can delete risky .swf files from your server.

If you let users upload their own .swf files, you're 0% more secure than when you let them link to them.


I'm sorry to disappoint you, but there is no way to have flash for your users without (fairly large) security risks. UNLESS... you want to do a lot of manual work:

You Could have each user who wants to use flash, send you the .fla source file. Then you review the source file thoroughly to make sure there are no dangers in using it whatsoever. Then you compile it to a .swf and store that on your server, and THEN the user can use it.

That will give you as much security against flash-abuse as far as your own flash skills go. If your flash skills are crap, you've still got security problems. If you're a flash master, you're likely to be safe.

Keep in mind though that any .swf that users give you can always be dangerous, cos you can't see the source anymore and you can't try every conceivable way of making malicious use of it. That would take a million lifetimes and then some, for each single .swf
Reply With Quote
  #15  
Old 10-25-2003, 09:47 PM
Tae-Hwan Tae-Hwan is offline
 
Join Date: May 2002
Posts: 29
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

ok, you keep telling me that it's not possible.. but if it weren't possible then i'm sure geocities/angelfire/xanga/every virtual host/etc wouldn't be allowing it.

what if every .swf file was uploaded to a certain directory, and it was restricted access to all other areas of the server except for that one directory? it wouldn't be too hard to disable the GET function for all files in that directory, either.

so in that scenario, what could the flash file possibly do? it is unable to access any information or receive any information. all it does is play its movie.

you keep telling me that it's a security risk, but i want to know why. i want to know the mechanics behind it.
Reply With Quote
  #16  
Old 10-25-2003, 11:06 PM
KuraFire's Avatar
KuraFire KuraFire is offline
 
Join Date: Oct 2001
Location: inside vB3's .php
Posts: 1,245
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

As far as I know, those sites have spent many thousands of dollars on implementing very intricate security systems against this. Personally, I doubt they're really 100% secure (I've yet to be convinced on how you can verify the workings of a compiled object without being able to see the source) but in their case I reckon they're mostly just using systems that have virtually no execution power at all.

Do you know what a BOA server is? If so, that could give you an idea of how such sites are (most likely) set up. Scripts (ie. php scripts and the like) cannot be executed because there is no PHP installed, etc. etc. etc.
By disabling a lot of such things you can dramatically limit what power any malicious file can have. For if a malicious file cannot execute any commands or anything, there's very little remaining that it can do.
However, since you're running a vBulletin forum, likely on a shared or dedicated hosting, meaning a server with apache and mysql and php and god knows what else installed, you don't have that option.

See the problem?
Reply With Quote
  #17  
Old 10-26-2003, 12:32 AM
indiamike's Avatar
indiamike indiamike is offline
 
Join Date: Oct 2001
Location: New Jersey, India
Posts: 124
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Take a look at this link http://eyeonsecurity.org/papers/flas...m#_Toc18055083

Which gives some examples of the risks that flash files can pose. That being said though, I would estimate that most flash developers wouldn't be able to do this or know how to but the risk is always there.
Reply With Quote
  #18  
Old 10-26-2003, 12:50 AM
filburt1 filburt1 is offline
 
Join Date: Feb 2002
Location: Maryland, US
Posts: 6,144
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Which gives some examples of the risks that flash files can pose. That being said though, I would estimate that most flash developers wouldn't be able to do this or know how to but the risk is always there.[/QUOTE]
I'd like to summarize (without reading the above posts ) that if you enable HTML or anything that supports scripting in posts/sigs/etc., you might as well shoot your forum in the head while you're at it. vB code is the safest you can get, and even then, custom vB codes can screw you over if you don't write them very carefully.
Reply With Quote
  #19  
Old 10-27-2003, 09:43 PM
indiamike's Avatar
indiamike indiamike is offline
 
Join Date: Oct 2001
Location: New Jersey, India
Posts: 124
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

So There....

I stuck my big nose in this thread and what happened? Yeah you can guess it I got hacked (sort of)

How did they do it?

Since I am/was using a Shoutbox on my site which allowed html the person embedded a flash redirect into the box to redirect everyone who visited my site to an adult site.

So there you go......This shows why any html is really sucky.


Kinda thinking that they read this thread and did it just to prove a point....hmmmm....

Mike
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 03:50 AM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04284 seconds
  • Memory Usage 2,236KB
  • Queries Executed 13 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (2)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (9)post_thanks_box
  • (9)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (9)post_thanks_postbit_info
  • (9)postbit
  • (9)postbit_onlinestatus
  • (9)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete