Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page.
The page in question is a log-in page.
Add a comment
|
As an end user, the simple answer to this is "just don't allow the banner to run." The term "banner" suggests to me that the applet is nonessential, i.e. blocking it wouldn't prevent the page from working.
As a webmaster, the obvious answer is to just accept that Flash is dead and remove the applet, as 90% of your users are not going to see it anyways unless you create a tutorial for them on how to go into their browser settings and re-enable flash and/or instruct them to allow the applet. Any tutorial materials you make will only work for the next 11 months anyways, until Flash leaves the browser for good.
For context, modern browsers are either single or double opt-in when it comes to Flash nowadays - they don't just run it automatically due to security concerns:
Chrome both requires Flash to be explicitly enabled in settings, then also enabled on a site-by-site basis. It will be removed entirely by December 2020.
Firefox requires Flash to be explicitly enabled on both a site-by-site basis, and also on an applet-by-applet basis, and Flash will be removed entirely by December 2020.
Edge requires Flash to be enabled on a site-by-site basis, and, you guessed it, support will be removed by December 2020.
Flash support for mobile browsers is rare - only less popular alternative browsers support it to my knowledge.
To answer your question directly, I wouldn't currently trust Flash to be secure. As its usage continues to decline, that means it has fewer and fewer eyes on it looking for security vulnerabilities, and major vulnerabilities such as arbitrary code execution have been discovered as recently as 2019. On the other hand Flash is client-side code, though, so to the best of my knowledge, any potential exploit would be limited to the context of the pwned user's machine. In other words, there's no way for an attacker to automatically "make the jump" and compromise the server, too, unless they find a separate server-side exploit to chain it with.
But this is only an issue if the user chooses to enable Flash in their browser settings, then explicitly allow the banner applet on your site to run. It doesn't make any sense to me to make a user jump through those hoops to enable a nonessential part of the page, therefore it makes more sense in my opinion to just remove the Flash applet.
On the other hand, if the banner actually is essential to the functioning of the page, then, well, there's also probably not much you can do to fix it besides rewrite the functionality without using Flash.
answered Jan 30 '20 at 18:00
-
To clarify your statement "I wouldn't currently trust Flash to be secure", does this mean even though it is just a flash ad banner that is non-essential at all to the functioning of the page, if a user chose to enable flash not understanding it was non-essential for the page to run, could it make the entire site for all users to be un-secure if an exploit was made, or only if you allow flash to run. In other words, could one end user make the site unsafe for all end users by choosing to enable flash? – Sam Buford Jan 30 '20 at 18:33
-
1@SamBuford One user's machine being exploited would not inherently make the site unsafe for other end users, no. Flash is client-side code, so to my knowledge it can't do any wacky server-side magic. The attacker would be limited at most to what they could do with full control over that specific user's computer - e.g. logging in as that user, sending malicious requests, etc.. This could make it easier for an attacker to find server-side exploits to chain onto, but they would need a server exploit (or to compromise and impersonate an admin account) to actually affect any other users. – Maximillian Laumeister Jan 30 '20 at 18:45
-
@SamBuford As a side note, I've got a burning curiosity: Is this question a hypothetical, or do you actually have an advertiser who is paying you real money to show ads that are blocked by 90% of your users? If so, your CPM must be off-the-charts. – Maximillian Laumeister Jan 30 '20 at 18:47
-
1This current example is of a real companies website, not my own. I will not disclose the company. Your comment is precisely why I asked the question, since I can not understand why the site in question hasn't just gotten rid of the ad, or at least indicated to the advertiser that the ad is being blocked x% of the time, and they should rewrite their ad in html5 if possible. Long story short, my worry is many of the end users are enabling flash out of fear that it is integral to the site, and open themselves up to vulnerabilities,also indicating why the ad is still there. – Sam Buford Jan 30 '20 at 18:58
