Hewlett Packard (HP) has introduced a malware scanner for Flash developers.

The free utility, which helps programmers write secure code, is also capable of decompiling Flash applications and performing a static behavior analysis. This could help identify 'buried' vulnerabilities that are not detectable with traditional dynamic methods.

'HP Swfscan decompiles Flash applications and searches the code for vulnerabilities and violations of Adobe's best security practices guidelines,' Billy Hoffman, manager of HP's web security research group told IT Examiner. 'Sometimes developers think they are doing things securely when they really are not. Swfscan provides a check and balance,' he said.

According to Hoffman, Swfscan is the first free tool to decompile both ActionScript 2 and ActionScript 3 for analysis.

'Excellent decompilers such as Flare or OWASP's Swfintruder security tool have existed for a few years now. Unfortunately, the capabilities of free tools have not kept up with new Flash innovations such as the introduction of Flash 9 and 10, ActionScript 3, and Adobe's Flex framework. HP's Swfscan is the first and only free tool to decompile both ActionScript 2 and ActionScript 3 and analyze them for security vulnerabilities,' said Hoffman.

Hoffman explained that HP had downloaded and audited over 4,000 Flash applications while developing the scanner.

'We encountered numerous insecure applications and collected some interesting statistics. 77 per cent of SWF applications targeting Flash Player 9 and 10 contained developer debugging information and source code file references. 16 per cent of SWF applications for Flash 8 and earlier (showed) XSS vulnerabilities. (HP's utility) highlights the line of source code that contains the vulnerability to help better understand the context of the issue.'

Hoffman also noted that the scanner limited itself to examining flash applications running inside a browser.

'This is the SWF file that contains the Flash code Adobe's Flash player executes. It does not look at the components that run on the server. To conduct a complete security assessment of (a user's) applications, HP provides a suite of software and services for testing applications throughout (their) lifecycle,' added Hoffman. X


Check out the World news at our sister site The News