HP offers developers free Flash-app security tool
Published: 23 Mar 2009 14:23 GMT
HP is set to announce on Monday a free tool that developers can use to check for holes in the Flash applications they write, which can lead to data leaks and other security problems on websites.
HP SWFScan decompiles Flash applications and searches the code for vulnerabilities and violations of Adobe's best security practices guidelines, said Billy Hoffman, manager of HP's Web Security Research Group. The tool works with all versions of Flash.
With the Flash Player installed on more than 98 percent of internet-connected computers globally, Flash applications are a popular target for attackers. HP analysed nearly 4,000 web apps developed with the Flash platform and found that 35 percent violate Adobe's security best practices.
For example, encryption keys and other sensitive data have been found inside client-side Flash code, Hoffman said.
Flash, traditionally used for creating animation and games, has been used increasingly for Web 2.0 applications destined for enterprise use, for which tighter security measures are required, he said.
This is not the first tool aimed at Flash developers. IBM last month announced its Rational AppScan, which automatically scans Flash and Ajax-based applications for security defects. The standard version of that product costs $17,550 (£12,000) for a one-year licence.
Last year, HP was called upon by Microsoft to develop a free tool, Scrawlr, which developers can use to test for SQL injection vulnerabilities in apps on Microsoft's ASP platform, according to Hoffman.
While developers are striving to write more secure Flash apps, Adobe occasionally is forced to deal with security holes in the Flash Player itself. For instance, Adobe recently issued a patch for a hole in the player that could allow an attacker to remotely take control of a computer.
Credit: HP offers free security tool for Flash developers from CNET News
Did you find this article useful?
3 out of 3 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
