New Tool For Discovering Flash player 0-Day Attacks in the Wild from Various Channels

on YouTube ↗17m

" summary

Claims 2015 is the Year of Flash and documents finding several Flash 0-days (starting CVE-2015-0310 through CVE-2015-7645) and reporting dozens of Android bugs to Google. Builds an automated C++ tool called Advanced Flash Exploit Detector (FED) that hooks Flash OCX in IE, captures AS3 verification/native calls, records created object addresses and vector lengths, and emits behavioral logs and heuristic rules (byteArray/bitmapData/byteArray3 patterns) to keep false positives extremely low while processing large URL and feed-derived sample sets.

AI-written summary · about

" chapters (18)

1. 0:00Introduction
2. 0:27Who am I
3. 1:12Background
4. 2:28Problems
5. 3:08Sources
6. 4:39Intelligence
7. 6:15Advanced Flash Detector
8. 7:17How to Implement AFED
9. 8:34Detection Flow
10. 9:30GIDHook
11. 10:52WorkCreating
12. 11:07Detection
13. 11:30Object import
14. 12:11Improved APD
15. 13:18Behaviors
16. 14:22OCX Loading
17. 15:18TC Reference
18. 15:34Demo

" related talks

• 47mThe Art of Reverse Engineering Flash ExploitsJeong Wook Oh · Black Hat USA 2016
• 40mThe Year in FlashNatalie Silvanovich · Black Hat USA 2016
• 01h 05mFinding and Fixing Security Bugs in FlashNatalie Silvanovich · USENIX Security '16
• 51mWindows 10 Mitigation ImprovementsDavid Weston, Matt Miller · Black Hat USA 2016
• 50mDynamic Flash Instrumentation for Fun and ProfitTimo Hirvonen · Black Hat USA 2014
• 35m0-day In-the-Wild Exploitation in 2022...so far.Maddie Stone · 34th Annual FIRST Conference 2022
• 53mFive Years of 'Make 0Day Hard'Ben Hawkes · Black Hat USA 2019
• 36m"Playing in the Sandbox: Adobe Flash Exploitation Tales"Björn Ruytenberg · CONFidence 2019