Re: [Gnash] spyware buried in Flash movies

[strk]

On Tue, Jan 31, 2006 at 05:49:48PM +0000, Alias wrote:

> The main reason for the crossdomain policy, for security, is to
> prevent this scenario:
> 
> 1) User on large network views page with hidden flash malware content.
> 2) Malware uses hidden http requests/port scanning to map that clients
> internal subdomain (private network), discovers network structure
> 3) Malware sends that private info via http, unbeknownst to the user
> 4) Attacker uses data to tailor attack

On point (2) Gnash might ask the user:

        A Flash movie loaded from <SOURCE_IP>/<SOURCE_DOMAIN>
        is trying to load a resource from <DEST_IP>/<DEST_DOMAIN>
        What should I do ?

                a) allow <SOURCE> to load from everywhere
                b) allow <DEST> to be loaded from everywhere
                c) allow <SOURCE> to load from <DEST>
                d) do what MM player would do 

        Options: [] only for this session, [] always

--strk;