Skip to main content

Security Researcher Bypasses Adobe Flash Sandbox

A Microsoft security research has found a way to bypass the sandbox technology deployed by Adobe to protect its Flash Player software.

In a blog post, security researcher Billy Rios detailed the process of bypassing the technology, developed to help protect users from hackers attacking through the software.

The sandbox isolates Flash Player on local computers, allowing it to read local files but preventing it from sending data over a network. It also prevents the software from making HTTP or HTTPS requests.

The researcher explained that he could bypass the sandbox by reformatting the request sent to the software, such as "file://request to a remote server", using a local Internet protocol address and hostname.

As Adobe has blacklisted some of the IP handlers suspected of malicious activities, all he had to do was find an IP address which was not blacklisted by Adobe.

"If we can find a protocol handler that hasn't been blacklisted by Adobe and allows for network communication, we win," Rios wrote.

The method could allow hackers to steal data and send it to a remote server, he explained.

An Adobe spokesperson, clarifying the matter, later said:

“An attacker would first need to gain access to the user's system to place a malicious SWF file in a directory on the local machine before being able to trick the user into launching an application that can run the SWF file natively. In the majority of use scenarios, the malicious SWF file could not simply be launched by double-clicking on it; the user would have to manually open the file from within the application itself.”