Adobe updates Flash to tackle 'clickjacking' - 17/10/2008
- Adobe has released a new version of its Flash Player software, fixing a critical security bug. The new Flash Player 10 software fixes security flaws in Adobe's multimedia software including bugs that could allow hackers to pull off what's known as a clickjacking attack, wrote Adobe spokesman David Lenoe in a blog posting.
- For those who can't update to this new version of Flash, a Flash 9 security patch is still about a month off, he added. Adobe rates the clickjacking bug as 'critical'.
- Flash isn't the only software that is vulnerable to a clickjacking attack, but Flash attacks have been considered among the most dangerous.
- In a clickjacking attack, the hacker users a variety of techniques to take control of what links the victim is actually clicking.
- In one attack, for example, the attacker would first have to trick the victim into visiting a malicious web page and then clicking on what appeared to be a regular web link.
- In reality the victim would be clicking on something altogether different such as a Flash object that turned on his microphone. "It's almost impossible for a user to determine what's going to happen when they click on a link," said Hansen, who is CEO of SecTheory.org, in an interview last week.





