Finding and Fixing Security Bugs in Flash

on YouTube ↗01h 05m

" summary

Work over a year reduces Flash bug density from roughly one bug per day down to 1 bug per week by code review, IDA reverse engineering and mutation fuzzing (scan-and-mut8ate SWFs, add AC-filled frees to expose UAFs). Key mitigations actually implemented: vector checksum mitigation then iso-heap partitioning plus JIT-spray hardening and zero‑freeing; some exploit kits fail, others adapt using bytearray/bitmap or complex multi-stage payloads. Concrete examples: convolution-filter use-after-free, AVM serialization type confusion, movie-clip UAFs and a stack-uninitialized "park" bug; several mitigations stop some but not all real-world zero-days.

AI-written summary · about

" chapters (54)

1. 0:00Introduction
2. 0:37Who am I
3. 1:37Whats the problem
4. 2:15The landscape
5. 2:43The technical problem
6. 3:50Todays topics
7. 4:11Flash overview
8. 4:55The problem
9. 6:08Swift
10. 7:21Actionscript
11. 9:09Actionscript III
12. 10:49Anticorpus
13. 11:03Flash vulnerabilities
14. 12:16My goal
15. 12:35My current priority
16. 13:51Exploit bugs
17. 14:17How to find Flash bugs
18. 14:29Code Review
19. 14:52Convolution Filter
20. 17:22Array Overflow
21. 18:22Serialization
22. 20:51Exception Bugs
23. 22:47Type Confusion Bug
24. 23:28Use After Free Bug
25. 24:23Reverse Engineering
26. 25:08After Freeze
27. 27:06Early Conversion Example
28. 27:45Fuzzing
29. 29:53The Park Bug
30. 30:40Generic Exploit Techniques
31. 31:49Flash Exploits
32. 32:42The Vector Class
33. 33:28Use After Free
34. 33:50Vector Mitigation
35. 35:58ISO Heap
36. 37:26OneDay
37. 38:25Heap Overflow
38. 39:16IO Heap 2
39. 40:17Mitigations
40. 40:33Unwatched bug
41. 40:53String conversion
42. 41:41ASLR
43. 44:40Exception Handling
44. 45:46contiguous buffer
45. 46:26determine preferred locales
46. 47:29palettemap
47. 48:16second buffer
48. 48:26trigger the bug
49. 49:48virtual call
50. 50:16zero day
51. 51:36more complex exploits
52. 53:15more difficult to find bugs
53. 54:49Thank you Adobe
54. 55:03Questions

" related talks

• 40mThe Year in FlashNatalie Silvanovich · Black Hat USA 2016
• 47mThe Art of Reverse Engineering Flash ExploitsJeong Wook Oh · Black Hat USA 2016
• 51mWindows 10 Mitigation ImprovementsDavid Weston, Matt Miller · Black Hat USA 2016
• 17mNew Tool For Discovering Flash player 0-Day Attacks in the Wild from Various ChannelsPeter Pi · Black Hat Europe 2015
• 39mSoftware Security Engineering (Learnings from the past to fix ...)D. Mohanty · OWASP 20th Anniversary 2021
• 50mFix The Damned SoftwareJohn Steven · AppSec California 2015
• 35m0-day In-the-Wild Exploitation in 2022...so far.Maddie Stone · 34th Annual FIRST Conference 2022
• 39mA landscape of unintended consequencesSarah Allen · Code Mesh LDN 2019