Re: Flash Obfuscation

I'd have to agree with Brad. If you were going to risk assess this
solution you would probably find a degree of residual risk in the fact
you're relying in obfuscation in flash which would he susceptible to
unauthorised discovery and/or analysis. If you go down this path, make
sure the appropriate system/business owners are aware of this risk.

Christian "xntrik" Frichot

On Saturday, May 1, 2010, Brad Causey <[email protected]> wrote:
> My suggestion is to not use flash if the data is sensitive.
> Flash is reverse-able, and any obfuscation is simply security by obscurity, and will only make your life much harder, and the bad guys' lives a little harder.
> If you do decide to go down the obfuscation path, I'd suggest either coming up with your own mechanism, or hiring someone to do so. Don't rely on a tool. Just my opinion.
> -Brad Causey
> CISSP, MCSE, C|EH, CIFI, CGSP
>
> http://www.owasp.org
> --
> "Si vis pacem, para bellum"
> --
>
>
> On Fri, Apr 30, 2010 at 4:00 PM, 0x4150 <[email protected]> wrote:
>
>
> My company had a pen test of the application and the tester reported
> that we should obfuscate the flash content. I would like to make it as
> difficult as possible for an attacker to reverse and understand the
> application logic. The application deals with sensitive data so I want
> to protect it (as much as possible). I was told there were ~3 products
> on the market which can obfuscate flash, but none seemed reputable.
>
> On Fri, Apr 30, 2010 at 6:58 AM, Brad Causey <[email protected]> wrote:
>> What's your goal? Maybe thatll help us help you.
>>
>> On 4/30/10, Paul Melson <[email protected]> wrote:
>>> On Thu, Apr 29, 2010 at 2:05 AM, 0x4150 <[email protected]> wrote:
>>>> Has anyone done obfuscation of a flash application? If so, what
>>>> tool(s) would you recommend?
>>>
>>> I wouldn't recommend any of them as a way to actually secure anything
>>> as the end result must still be a SWF file that Flash Player can parse
>>> correctly, and therefore they can be decompiled or debugged in order
>>> to reverse the code.
>>>
>>> The only example of obfuscated ActionScript that I've seen to date has
>>> been a malware dropper. In that case it was about 20 minutes by hand
>>> to reverse. About 1 minute for Wepawet to do the same.
>>>
>>> PaulM
>>>
>>>
>>>
>>> This list is sponsored by Cenzic
>>> --------------------------------------
>>> Let Us Hack You. Before Hackers Do!
>>> It's Finally Here - The Cenzic Website HealthCheck. FREE.
>>> Request Yours Now!
>>> http://www.cenzic.com/2009HClaunch_Securityfocus
>>> --------------------------------------
>>>
>>>
>>
>> --
>> Sent from my mobile device
>>
>> -Brad Causey
>> CISSP, MCSE, C|EH, CIFI, CGSP
>>
>> http://www.owasp.org
>> --
>> "Si vis pacem, para bellum"
>> --
>>
>
>

-- 
Christian Frichot
e: [email protected]
p: 0433 490 117
w: http://un-excogitate.org

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA