Standford University student Feross Aboukhadijeh found vulnerability in Adobe Flash Player that allows any website to spy on their visitors. This vulnerability allows the attacker to turn on webcam and Microphone without your knowledge.
He tested this vulnerability in all versions of Flash Player. He confirmed that it works in Mozilla firefox and Safari browsers.
There’s a weird CSS opacity bug in most other browsers (Chrome for Mac and most browsers on Windows/Linux). Vulnerability Status:
- Type: Clickjacking
- Application: Adobe Flash Player
- Alert Level: Critical
- Status: Fixed
He tested this vulnerability in all versions of Flash Player. He confirmed that it works in Mozilla firefox and Safari browsers.
He reported about this vulnerability to Adobe few weeks ago. As there is no response from adobe, he released it publicly in order to create awareness.
Now Adobe Fixed this vulnerability. Yesterday Adobe said that they posted a fix to the Settings Manager that should resolve the issue.
Here is the Video Demo of Vulnerability:
He combined the Clickjacking technique with Adobe Flash Player Setting Manager page.
How does this attack works?
Instead of iframing the whole settings page (which contains the framebusting code), he just iframe the settings SWF file. This let me bypass the framebusting JavaScript code, since we don’t load the whole page — just the remote .SWF file. he said he was really surprised to find out that this actually works!.SWF file as important as one that controls access to your webcam and mic!
This is a screenshot of what the Settings Manager .SWF file looks like:
Here is the live Demo of this Attack:
https://www.feross.org/hacks/webcam-spy/
