Hackers Exploit 'Flash' Vulnerability in Yahoo Ads

The reason Native Client exists extends well beyond Adobe Flash Player. Native Client exists to enable your browser to run native code from any website (think compiled C and C++ code) without it being able to compromise the security of your machine.

Thanks for the authoritative reply!

If Flash doesn't run under NaCl why use the PPAPI? Wouldn't libc be much more convenient, since you don't have to port Flash to the PPAPI?

Furthermore, I would imagine using the PPAPI directly wouldn't do much to enforce security since Flash can do whatever it likes in it's virtual address space, including jumping past checks and assert instructions in the PPAPI?

If Flash doesn't run under NaCl, does it run under the same user and privilege as Chrome?

Finally, can you comment on this quote from http://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-te...:

> Several reports on Twitter suggested the exploit could be used to bypass Google Chrome‘s protective “sandbox” technology

It's frustrating that there is no source. However, the above quote would suggest that Flash runs inside NaCl. Is this factually incorrect?

I recall that Chris Rohlf presented an implementation defect in one of the two at a Black Hat conference some years back, but the sandboxing is otherwise solid.

Where possible, I do, as well!

The problem is that instead of the browser streaming user interaction events to the Flash (or any NPAPI plugin) process and asking for a render from time to time, the plugin window is overlaid on the browser, and waits patiently for events streaming down from the mighty plugin.

Okay, so open up the management interface for my SAN. Yes, I want to allow Java to run. Yes, I know it's not signed. No, I don't care.

Okay, now I have to go add the domain to an obscure control panel because a freakin' popup is too much to ask.

Now I go reload the page, yes I want to run the plugin, no I don't care that it's unsigned, yes I know that this may hose my computer, yes* i want to load the damned applet already.

Combine that with the fact that the Java web plugin sandbox and all this security appears to be trivially bypassed, and I wish they'd screw off with the multiple confirmation prompts and let me just control it with the browser.

* The number of times I've cared about the code signing status of any application in the last decade can be counted on one hand.

FireFox now has changed the default to click-to-activate for the Flash plugin, but this behavior a couple of years ago led me to enable click-to-activate on all my computers, when I opened up an older machine I hadn't fired up in a while and noticed that Flash was conveniently disabled everywhere.

Until FF's recent change, this behavior broke a lot of websites, and clearly now they're fixing their interaction with click-to-activate behavior. Some sites would have an element with js handlers over the flash plugin for ads or something else, some would just display a message that's like, "You should download the flash player", which meant they were entirely broken.

As for version blocking you are correct that that falls entirely on Adobe and the browser.

One of the most difficult parts of an attack like this is to get people to actually "run" the malicious code. In this case that meant loading some flash object. Embedding malicious flash is one of the easiest ways to get a person to run your code, but you need a popular site to do anything large scale. Yahoo is responsible in that they own a vector (their ad network paired with their popular web properties) that makes this large scale distribution trivially simple for the attacker.

Content providers (web property owners) should be responsible for the ads that get served on their site but, given how the ecosystem has evolved, they have very little control. The most a content creator can do is switch to a different ad network. This case is interesting because the ad network and the content property were owned by the same entity; switching networks makes no sense.

The quality/safety of ads is left up to the network and the ad creators. Obviously the creators cannot be trusted. The network has little incentive to police thoroughly (although it seems like Yahoo did take some action in this case). There is such a glut of ad real estate that individual content creators have effectively zero power to affect change. If one of the networks strove to promise a better experience for the content providers (and us; the ultimate consumer) it could cause content providers to switch networks. But that costs money and no ad network has the incentive to be first. They simply don't need to in order to continue being competitive.

It will be interesting to see what happens in the next few years. It seems like companies (Apple in particular) are starting to try to gobble up as much content as possible. If enough providers sign on to such programs, these "co-ops" could have significant bargaining power with regards to the ad networks. But who knows what other issues will crop up. Today everybody has a website or a blog that they need to independently monetize via ads. Grouping together under the banner of a large company could work well for them, or they could effectively become web serfs. It'll be interesting to see either way.