Abstract: Security misconfiguration is #5 on the OWASP 2013 Top 10. This talk shows how the misconfiguration of one file can compromise the security of an entire web application.
In the talk, youll be introduced to the crossdomain.xml file. This file determines how third party Flash Objects (SWFs) hosted on other domains can interact with your domain. Unfortunately, this file requires manual configuration on the part of the administrator, and as we all know, when manual configuration is required, mistakes happen.Sometimes, administrators give up and whitelist the entire internet in order to “make it work”. This is essentially like adding an “accept all” rule on your firewall or setting your password to <blank>.
We will review how to identify the vulnerability, how to abuse it, and how to write your own SWFs that exploit the flaw. Examples of public sites that until recently contained this vulnerability will be provided, including a few from the Alexa Top 100.
Print
Share
Comment
Cite
Upload
Translate
APA
() » DerbyCon 4.0 – SWF Seeking Lazy Admin for Cross Domain Action. Retrieved from https://www.truth.cx/2014/10/10/derbycon-4-0-swf-seeking-lazy-admin-for-cross-domain-action/.
MLA" » DerbyCon 4.0 – SWF Seeking Lazy Admin for Cross Domain Action." - , https://www.truth.cx/2014/10/10/derbycon-4-0-swf-seeking-lazy-admin-for-cross-domain-action/
HARVARD » DerbyCon 4.0 – SWF Seeking Lazy Admin for Cross Domain Action., viewed ,
VANCOUVER - » DerbyCon 4.0 – SWF Seeking Lazy Admin for Cross Domain Action. [Internet]. [Accessed ]. Available from: https://www.truth.cx/2014/10/10/derbycon-4-0-swf-seeking-lazy-admin-for-cross-domain-action/
CHICAGO" » DerbyCon 4.0 – SWF Seeking Lazy Admin for Cross Domain Action." - Accessed . https://www.truth.cx/2014/10/10/derbycon-4-0-swf-seeking-lazy-admin-for-cross-domain-action/
IEEE" » DerbyCon 4.0 – SWF Seeking Lazy Admin for Cross Domain Action." [Online]. Available: https://www.truth.cx/2014/10/10/derbycon-4-0-swf-seeking-lazy-admin-for-cross-domain-action/. [Accessed: ]