Adobe WebCam privacy invasion flaw in Flash - Fixed?

Adobe has fixed a privacy invasion flaw in Flash that allowed remote spies to turn on a computer user’s webcam via a rigged web site.


The vulnerability, discovered and documented by researcher Feross Aboukhadijeh, is a variation of the clickjacking technique and could be used to turn on a webcam and microphone direct from a web site without the user’s knowledge or consent.

In this video, Aboukhadijeh documents the attack scenario:



Adobe says the issue is now fixed:

Adobe is aware of a report describing a clickjacking issue related to the online Flash Player Settings Manager. We have resolved the issue with a change to the Flash Player Settings Manager SWF file hosted on the Adobe website. No user action or Flash Player product update are required.

If, like me, you are paranoid about these kinds of bugs activating your webcam, do the smart thing and put a sticky over the camera.  Matter solved.

Farewell Flash? Adobe Launches HTML5 Web Animations Tool "Adobe Edge"

Today, Adobe is launching a new tool called Adobe Edge which will allow creative professionals to design animated Web content using Web standards like HTML5, CSS and JavaScript. 

Not Flash.Aimed to coexist with Adobe Flash, not replace it, the Web design software is Adobe's big bet on how it will continue to solidify its position as a top player in the infrastructure of the modern Web, especially as the Web goes increasingly mobile.

In this new mobile context, the Web has become a more hostile environment for Flash, which has no place on Apple mobile devices, and likely never will.

Adobe claims it has been a strong player in HTML5, going back to April 2010, when it first began introducing support for the technology in its product line, including Dreamweaver, Illustrator, its Digital Publishing Suite and, more recently, its Flash-to-HTML5 conversion tool, Wallaby.

Now, with Adboe Edge, it aims to provide the tools that will help professionals build Web animations, and in the future, even simple games.

At present, Edge will focus on its core animation engine, but in the future, it plans to add more HTML5 features, including Canvas support, support for HTML5 Audio and Video tags, richer support for animating SVG graphics and more.

The software (for both Mac and PC) is designed to have an intuitive paneled user interface, a fast startup time, and will include, at the bottom, the familar timeline feature creative professionals already know and understand.

Edge users can import existing HTML documents and graphic assets including SVG, PNG, JPG and GIF and then sytle them with CSS3.

Panels on the left and right provide access to properties of the .EDGE file and the various elements the designer is working with and in the centre, there runs an embedded version of the WebKit browser.

When a project is complete, it will work on modern Web browsers like those that run on Android, iOS, HP's webOS, the BlackBerry PlayBook, plus Firefox, Google Chrome, Safari and Internet Explorer 9.

Where to Get Adobe Edge

Starting today, Adobe Edge is available as a free download while in its public preview period. The 1.0 product is expected to launch next year.

This is a hugely important launch for Adobe - one that IDC analyst Al Hilwa, says is "the biggest thing they have done so far." Hilwa likes Adobe Edge, and believes it shows that Adobe is really in-tune with designer needs.

Farewell Flash? Adobe Launches HTML5 Web Animations Tool "Adobe Edge"

New malware overwrites Adobe and Java software updaters

For the first time security researchers have spotted a type of malicious software that overwrites update functions for other applications, which could pose additional long-term risks for users.

The malware, which infects Windows computers, masks itself as an updater for Adobe Systems' products and other software such as Java, wrote Nguyen Cong Cuong, an analyst with Bach Khoa Internetwork Security (BKIS), a Vietnamese security company, on its blog.

BKIS showed screen shots of a variant of the malware that imitates Adobe Reader Version 9 and overwrites the AdobeUpdater.exe, which regularly checks in with Adobe to see if a new version of the software is available.

Users can inadvertently install malware on computers if they open malicious e-mail attachments or visit Web sites that target specific software vulnerabilities. Adobe's products are one of the most targeted by hackers due to their wide installation base.

After this particular kind of malware gets onto a machine, it opens a DHCP (Dynamic Host Configuration Protocol) client, a DNS client, a network share and a port in order to received commands, BKIS said.

Malware that poses as an updater or installer for applications such as Adobe's Acrobat or Flash are nothing new, said Rik Ferguson, senior security adviser for Trend Micro.

Decent security software should detect the malware, but those people who do become infected could be worse off even if the malware is removed, Ferguson said.

"They will lose the auto-updating functionality of whatever software is affected even after the malware is cleaned up," Ferguson said. "That could of course leave them open to exploitation further down the line if critical vulnerabilities don't get patched as a result."

That means that users would need to manually download the software again, which they may be unlikely to do if they don't know the effect of the malware.