New Flash Preference Pane Still Struggles to Help Protect Privacy of Users

Adobe has added a new Preference Pane for Flash for Mac OSX, which allows you to control Flash Privacy and Update Notification via a standard MacOSX Preference Pane. While this is a good step, the problems which existed with the Setting Manager still exist in the Preference Pane when it comes to the handling of Local Shared Objects (LSO) otherwise know as Flash Cookies. Below we expose the various issues with the Preference Pane, mainly when you select Storage>Delete All and Advance>Delete All site data remains. 

The Flash Player Preference Pane

 

The Flash Player Preference Pane replaces the clumsy Setting Manager for Flash which ran directly from the Browser. One great feature of the pane is the management of Flash updates which was horrible in the Setting Manager. The Advanced tab enables you to determine the version installed and provides a direct link to the About Flash Player page. You also have the capability to set storage and privacy controls for the camera and microphone. "Private Browsing" is supported in Safari 5.0.5, thus private browser session information including Flash content is not stored in the usual directories ~/Library/Preferences/Macromedia/Flash Player/macromedia.com or ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects. 

Sounds Good, So What is the Problem

We have discovered that if you visit a site with "Allow sites to save information on this computer" enabled in the Preference Pane or had previous sites that stored information the "Delete All" button does not provide the protection describe here on Adobe's site and below.

After reading this you would expect buttons labeled "Delete All" to perform as advertised and remove all content saved from sites. This is not always the case, and some data remains, similar to the failures in the Setting Manager, thus the "Delete All" does not perform as expected. In our demo we will clearly show that the Flash Player Preference Pane does not work properly resulting in Flash Cookie (LSO) data remaining on the system. 

Note : (For our demo we will be using Philipp Kostin Flash Site Demo titled "Flash Cookies: Local Shared Objects" to create the data and Flash Cookie (LSO).)

Follow these steps to duplicate our results in the video that follows:

• Go to ~/Library/Preferences/Macromedia/Flash Player/macromedia.com and leave open.
• Go to ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects and leave open.
• Select System Preferences>Flash Player>Storage and enable  "Allow Sites to save information on this computer"
• Visit a site that writes some date via a Flash Cookie (LSO), in our example we used Philipp Kostin Flash Demo. 
• Write some information using the demo or from any other Flash Site of your choice.
• Change your settings in System Preferences>Flash Player>Storage to "Block all sites from storing information on this computer."
• Click on "Local Storage Settings by site" and view any site information. Did a site show up?
• Try "Delete All" in System Preferences>Flash Player>Storage and System Preferences>Flash Player>Advanced.
• Notice that the data in the Flash Cookie (LSO) remains. 

Wasn't This Always a Problem?

In previous versions of Flash Player for Mac OSXdeleting site storage did not remove all the Flash Cookies (LSO) including the .sol file and a folder with the site name. This was one of the many issues which made using the Setting Manager very frustrating. Flash Cookies (LSO) have raised all kinds of privacy issues since they were first used, and that continues to be the case even if Adobe has introduced a Preference Pane. 

In the Flash Player Preference Pane the language is clear so we expect that "Delete All" would do exactly as expected. In our demo this was not the case. The only solution that worked one hundred percent of the time was to manually remove Flash Cookies (LSO) and then enable "Block all sites from storing information on this computer."  

Conclusion

In the current state the Flash Player Preference Pane for Mac OSX does not work as advertised, thus it continues to be a work in progress. The Flash Player Preference Pane clearly does not improve the management of Flash content privacy. In fact, the Flash Player Preference Pane will result in users having a false sense of privacy. It is our hope that Adobe was making an attempt at making Flash privacy easy to manage and not trying to layer the issue of privacy in a veil of confused user interaction. Take a chance Adobe, your business goals can be met while providing users and developers with clear dependable controls over Flash Cookies (LSO) and their privacy. The other option is to agree with Steve Jobs and move away from the Flash Platform.

Update on Saturday, November 12, 2011 at 11:33AM by Sean OConnell Public

It does appear that the latest version of Flash Preference Pane does delete site specific saved files from ~/Library/Preferences/Macromedia/.

Google Chrome 10.0.648.205 released

Google has released Chrome 10.0.648.205 to the stable channel which fixes the Flash Zero day along with the listing below. (Mac Only)

• [75629] Critical CVE-2011-1301: Use-after-free in the GPU process. Credit to Google Chrome Security Team (Inferno).
• [$1000] [78524] Critical CVE-2011-1302: Heap overflow in the GPU process. Credit to Christoph Diehl.

Adobe's update for Flash Fast tracked

Adobe will have a Flash Update ready on Friday April 15, 2011. Users should install this update if they need to use Flash. Our current Risk analysis has determined that if you do not need Flash for critical business functions then it should not be installed on your systems. We further recommend that you do not install Flash on any servers. 

Adobe will also have an update for Reader and Acrobat no later then April 25, 2011. Again, we recommend that you do not install Reader on any Mac OSX Server. For PDF use Preview.app, it will suffice for most cases. 

We will be removing all Flash content from our site by Saturday April 16,2011.

Adobe Releases Updates to Reader, Acrobat and Flash

Adobe has released updates to Reader, Acrobat and Flash to address the various 0Days which have been used in the wild since the advanced notice. All three products should be updated. We also recommend the following moving forward:

• Do not install any Adobe products on production servers.
• Preview.app should remain the application of choice to read PDF files.
• Install Click to Flash, NoFlash or NoScript to limit Flash.
• Change you Flash Control Panel Settings to maximize privacy.  
• After an update your Flash Control Panel Settings change, set them to maximize privacy. 

 Check the referenced links below for more information directly from Adobe. 

Flash Update 10.2.152.26 Released->Installed with Acrobat Update

Adobe has released an update of Flash to address the following vulnerabilities. Adobe Reader and Acrobat users who installed the update and read the Acrobat Reader Release Notes may have noticed that the update installed this updated version of Flash. Make sure to confirm you Flash privacy settings once you install the latest version, disable P2P uplink or always ask.

• This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2011-0558).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0559).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0560, CVE-2011-0561).
• This update resolves multiple memory corruption vulnerabilities that could lead to code execution (CVE-2011-0571, CVE-2011-0572, CVE-2011-0573, CVE-2011-0574).
• This update resolves a library-loading vulnerability that could lead to code execution (CVE-2011-0575).
• This update resolves a font-parsing vulnerability that could lead to code execution (CVE-2011-0577).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0578).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0607).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0608).
• Adobe recommends users of Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris update to Adobe Flash Player 10.2.152.26.