Curl Developer Community: Curl Blog: Why Criminal Hackers Will Love Adobe AIR

Previous Next

Curl Blog

Currently Being Moderated

Why Criminal Hackers Will Love Adobe AIR

Posted by Bert Halstead on Apr 16, 2008 7:39:15 PM

Adobe has released their new AIR product with much fanfare about letting developers "[use proven Web technologies to build rich Internet applications that deploy to the desktop and run across operating systems|http://www.adobe.com/products/air/]." The grand vision that's being promoted is that AIR is pioneering the application development model of the future, where cross-platform applications will be developed using a platform-independent tool such as AIR, and then deployed across the Web as downloadable gadgets that can be installed on any computer.

The concept is attractive, but there are several weaknesses in the way AIR implements it. One of these weaknesses is performance: while the speed of AIR's execution engine may be fine for gadgets, will performance that is still an order of magnitude slower than native code be acceptable for serious applications like Adobe's own Photoshop? (Note that the recently released Photoshop Express service is not an AIR application; it's a server-side application with a Flex front end.) A second weakness is the complexity of the AIR execution architecture: will future application developers really find AIR's conglomeration of JavaScript and ActionScript execution engines to be a more tractable development platform than a single, coherent, object-oriented execution environment? But the weakness I want to address today is AIR's security architecture.

Security is a central issue for any mobile code execution platform. When a user loads an application from a server, unless the user is able to verify the authenticity of the application and the trustworthiness of the application's provider, it is only prudent to assume that the application could be malicious. This is why Web browsers execute the JavaScript on a Web page inside a security sandbox that prevents the script from stealing information or damaging files even if it is malicious.

Some advanced mobile code platforms, such as Java and Curl, provide a sandbox for garden-variety untrusted applications, as well as a means for eliminating the sandbox restrictions for applications that a user determines can be trusted. Since trusted applications will have full access to the user's machine and network, it is very important that their origin can be authenticated. This is typically done by requiring that a trusted application be digitally signed by its provider, using a certificate issued by a recognized certification authority such as Verisign. This architecture extends the range of a platform, in a safe way, so it can handle a spectrum of application requirements that includes the features of typical desktop applications, many of which require fuller access than can be granted to an untrusted application running in a sandbox.

The designers of AIR obviously wanted to play in the desktop application space, so AIR applications have full access to the machine they are running on. But it seems that the AIR designers were unwilling to give up on also being a platform for casually loaded Internet gadgets, even though they did not see fit to give AIR a sandbox for running untrusted applications. The result is a mongrel security architecture that may impose costs on a lot of innocent people over time.

In a nod to the authentication requirements for trusted applications, Adobe says that all AIR applications must be signed. But the nod is an empty gesture, because AIR does not require signatures to be based on a certificate from a recognized certification authority! If you want, you can create your own certificate out of whole cloth and sign your AIR application with that! I have to guess that Adobe did this because they didn't want to cut themselves off from the casually loaded Internet gadget domain, and they weren't willing to require that the creators of such gadgets go through the process of obtaining a legitimate certificate.

Yes, if an AIR application's certificate is self-signed, AIR displays the publisher as "UNKNOWN", "[giving the user pause as to whether they should continue|http://blogs.adobe.com/stateofsecurity/2008/02/air_security.html]." But what detective work is the user expected to do? How many users will actually be able to do it? It seems more likely that if Adobe's dreams for AIR are realized, a generation of users will be trained in the habit of clicking "Install" for fully privileged AIR applets of unauthenticated provenance. Adobe has already begun this training program by posting a large number of self-signed AIR applications on the Adobe AIR Marketplace, including the DiggTop feed reader, twhirl Twitter client, and Google Analytics Reporting Suite, just to name a few.

The resulting situation will be a bonanza for criminal hackers. AIR will become the first truly cross-platform tool for distributing malicious applications. Macintosh and Windows, home and business computers will all be equal-opportunity targets for Trojan horse attacks, keystroke loggers, etc., truly realizing the dream of "write once, hack everywhere!"

Adobe can't have it both ways. Casually loaded Internet gadgets need to run in a security sandbox. Trusted applications need to be rigorously authenticated. Adobe needs to stop pretending that their self-signed application model provides a secure basis for running casually loaded applications with full privileges.

Tags: adobe, air, security, curl, ria, desktop, signing, sandbox, curl_blog

Add a comment Leave a comment on this blog post.

Apr 25, 2008 4:03 PM

John Dowdell says:

Hey, cool, thanks for adding comments... hadn't seen that when I checked earlier this week.

Your title is incendiary, but I understand how people feel they can get attention by being controversial. It's a sharp sword to wield, though.

You started out by comparing OS-neutral AIR instruction execution speed with that of OS-specific native code, such as Adobe Photoshop CS3. There are many other differences too... AIR doesn't access local device drivers and so on. These are different opportunities... the commitment of a native-code installation versus the universality of a Macs/Wins/Linii runtime. Not yet a germane argument.

Your attention-grabbing title seems to assume that the core of safety is based on the notion of identifying who the code creator is. This is faulty on many levels... as I noted in a <a href="http://www.google.com/search?q=verisignmicrosoftcertificates+stolen%22">linkat Gary Gilbert's blog, the integrity of a certificate is itself a constant question, so reliance on identity-certification alone is no panacea.

That said, identity-certification came up during the ActiveX days, when a new Control could be invoked by any website. This created a problem for Microsoft, in assuring that a download from a third-party site was actually a Microsoft download. It said nothing about how safe the download was; only that VeriSign or Thawte promised that the installer came from who it said it came from.

AIR has a very different security context. It is a way for anyone -- not just native-code developers -- to make an optimized beyond-the-browser experience. You'd download an AIR version from the creator yourself, and rarely as a third-party download on a site. The dynamics are different from an ActiveX install.

AIR has the capability to work directly with the local file system. You need to carefully consider whom you will trust with access to your file system. When you write "The resulting situation will be a bonanza for criminal hackers," you're leaving out the reason why people would install desktop applications from people they don't know or trust.

Returning to your title, why would "criminal hackers love AIR"? You left the core parts out, by focusing only on the ability to distribute self-signed as well as third-party-signed apps. There's a logical gap in your (rather hot) presentation.

jd/adobe

Apr 25, 2008 4:52 PM

Christopher Barber says in response to John Dowdell:

The problem is not in allowing people to decide they want to install potentially dangerous software that is not signed, but in making it too easy to do so.

Most users do not understand that it is not enough to trust the site that they downloaded the software from but also need to trust that no one has used DNS spoofing to get them to download software from a fake version of a site they trust. That is why verifiable signing is important. If an application is signed, then you can be sure it came from the right party regardless of any man-in-the-middle attacks. If you make it really easy for people to install self-signed applications, then all an evil hacker needs to do is to copy someone's popular application, insert some malicious code, post it on a spoofed copy of the website and get people to download it and run it. If the only difference in the installation process for certifiably signed and self-signed applications is the publisher name shown in the dialog, then 9 out of 10 people will go ahead and install it anyway. That is why hackers will like this feature.

I am not saying that people should not be allowed to install self-signed or unsigned applications if they want to, but the process should be different enough and require enough manual steps to ensure that the user has really had the chance to think the decision through and is not just clicking OK on every dialog.

Personally, I really don't understand the benefit of self-signing. Why bother signing at all if the signature cannot be verified?

Apr 25, 2008 7:21 PM

John Dowdell says in response to Christopher Barber:

Identity authentication has always been a useful security tool, but has never ever been a sufficient security tool. It provides confirmation of the identity of the publisher, but as noted above, has also been falsified, and the code itself can be subject to replacement. It is not a panacea.

For "why self-signing?", check into the three reasons Lucas Adamski provided in one of the links you cite.

Back to topic, why do you broadcast "Criminal Hackers Will Love AIR?" I still haven't seen a reason yet. Do you think they will get evil file-manipulating apps onto trusted third-party sites and then self-sign? That's my best guess of your visualization, from the argumentation I've read so far.

jd/adobe

Apr 25, 2008 10:54 PM

Christopher Barber says in response to John Dowdell:

It does not appear that you read my comment carefully. Did you miss the part about man-in-the-middle attacks? There is no such thing as a "trusted third-party" site without signing or at least https. Users can be fooled into downloading software from what they think is a site they trust but is really a fake. Just wait, and you will see it happen eventually. It is true that authentication is not by itself sufficient as a security tool, but that does not mean that you should just throw it out the window as Adobe has effectively done with this policy. As I said, the problem is not that unsigned/self-signed applications can be installed, but that the process for doing so is exactly the same as for signed applets making it way to easy for unsophisticated users to click without thinking. Obviously, Adobe's real goal here is to make it as easy as possible for people to write AIR applications that end up on people's desktops and are willing to sacrifice end user security in order to to get that.

I can see the argument that self-signing could be useful for testing, but don't really understand how it helps "workflow" or why it would be helpful in an Enterprise setting. You trust the content you download from inside of your firewall because it comes from inside, not because it was signed by a certificate that gets displayed as "UNKNOWN".

Apr 26, 2008 9:29 PM

John Dowdell says in response to Christopher Barber:

"It does not appear that you read my comment carefully. Did you miss the part about man-in-the-middle attacks?"

Well, brevity, and getting to the point, do help, y'know....

Am I now correctly understanding your core argument as "Criminal Hackers Will Love AIR! Because! Someone might do some type of man-in-the-middle attack, or maybe even a phishing site-impersonation, during download!!"

I'm not interested in arguing for arguing's sake, but I am interested in passing along any security concerns I hear. Is the above your core issue? If not, then what?

jd/adobe

Apr 26, 2008 11:42 PM

Richard Monson-Haefel says in response to John Dowdell:

I find it really interesting that Adobe is so ignorant of their own Adobe AIR security problems. I'll explain the problem as clearly and with as much brevity as I can. Please read carefully.

Adobe AIR applications have full system access to the machines that they run on. This means they can do pretty much anything that a natively installed application can do. They can access any directory they like, overwrite files, modify files, read any file they like and communicate their findings to any host on the Internet. In laymen terms (I'm a laymen so I can't help but talk from that perspective) Adobe AIR offers no security at all. Adobe has offered three extremely lame counter arguments to this including: We sandbox remote code, we never promised you security, and Adobe AIR applications will only be available from established and respected web sites.

1. Remote Code:
Adobe AIR applications have full system access. For example, I could write a tic-tac-toe game in Adobe AIR that installs spyware or writes a rootkit the first time it runs on your desktop. If that game itself accesses remote code after its installed, like a JavaScript program, that JavaScript will be sandboxed, but so what. The actual AIR application is not sandboxed. It's kind of like locking the doors after you invited a complete stranger into your house. It doesn't make a lot of sense.

2. We never promised you security
When the full system access problem is brought up in a public forum, Adobe falls back on the excuse that "we never said it would be more secure than native applications". This is true. While Adobe did imply it was more secure by talking about their remote security sandbox, they never said AIR applications themselves were secure. Our response to this is: "Well, thanks for nothing". You just took everything the industry has learned about security in the Web and thrown it out the window.

3. Now John Dowdell introduces the latest and lamest of Adobe excuses: AIR applications will be available from reputable web sites that you can trust. To which I say, "What are you talking about?" First, why won't Adobe AIR applications be available on other web sites like porn.com or momandpop.com? In fact, if Adobe AIR is successful AIR applications will be available from all over the place. People will not always get them from Adobe Marketplace. The same thing that led to viruses everywhere today will lead to Adobe AIR viruses everywhere tomorrow. People download applications from all over the place and in many cases do not consider the security risk. Second, are these "reputable" web sites like Adobe Marketplace going to vigorously examine each and every 3rd party application made available from their site to ensure they don't have hidden viruses or time-bombs or rootkits. I doubt it. If they do then the market place is going to be very expensive to run and will grow extremely slowly.

I figure Adobe is guilty of one of two things: Either they are incredibly naivete or they think everyone else is incredibly naivete. Which is it?

Apr 27, 2008 10:22 AM

Christopher Barber says in response to John Dowdell:

Brevity? My point about DNS spoofing was in the second sentence of my comment. Did you not read that far?

Of course, the problem with computer security issues is that they rarely can be described in a sentence or two and usually require a good deal of thinking to fully understand. Most end-users do not have the time or inclination to do so, and often do not take security issues seriously until they are stung by them; your response is a prime example of this. This is why it is important for security architects at companies like Adobe, Microsoft and Curl to be paranoid on the user's behalf. I have no doubt that Adobe has some people who fully understand these security issues, but it appears that they must have been overruled by Marketing on this point.

Apr 27, 2008 6:44 PM

John Dowdell says in response to Richard Monson-Haefel:

"why won't Adobe AIR applications be available on other web sites like porn.com or momandpop.com?"

I'm trying to find your core concern, so that I can accurately relay it to others. My previous guess about the man-in-the-middle/phishing stuff seems wrong, then, because now we're onto porn sites.

Yes, a porn site may offer an AIR app. I wouldn't install it myself. Do you think enough other people will, and that's why "criminals will love it"?

(I would not expect much in the way of third-party distribution sites, not when AIR delivery can be done so easily directly.)

"I figure Adobe is guilty of one of two things: Either they are incredibly naivete or they think everyone else is incredibly naivete. Which is it?"

Yes, I stopped beating my wife. I mean, no I didn't stop beating a naif, no I, wait....

Summary: If you've got a reason "Why Criminal Hackers Will Love Adobe AIR", then I'd like to know what it is well enough to warn others, if needed.

jd/adobe

Apr 28, 2008 10:46 PM

Richard Monson-Haefel says in response to John Dowdell:

John,

I'm sure you are a decent fellow but it feels like you are being disingenuous in your lack of understanding. I think if you read over the original post carefully and the subsquent responses from cbarber and I you will probably grok the problem.

Richard

Apr 27, 2008 10:50 PM

Christopher Barber says in response to John Dowdell:

I think this has been explained ad infinitum. Anyone with a modicum of computer security experience will understand these issues. You clearly are not such a person, but I have no doubt that Adobe has several such people so there is no need to maintain the pretense that you need to pass on any warning to them. Adobe knows exactly what they were doing with this security policy: they are compromising end-user security in return for more AIR downloads. It might even be a good business decision for them. By the time there is the first publicized exploit they will probably manage to get AIR on a lot more desktops and can just issue a security patch to implement the behavior they should have had in the first place. After all, the numerous security flaws in Flash through the years have not prevented it from ending up in everyone's browser.

Apr 28, 2008 10:01 PM

Bert Halstead says in response to John Dowdell:

Several comments in this thread have asked the reasonable question of what Adobe really should do about security in AIR. In this domain I think there is really no substitute for providing a secure sandbox for applications to execute in. There is no reason why a person should have to turn over the keys to their machine in order to run a Nickelodeon Puzzle application, just to name one of the Adobe AIR showcase applications. Similarly, if proper crossdomain.xml files were provided on sites such as salesforce.com or ebay.com, there is no reason why salesforce and ebay AIR dashboards could not also be provided within a secure sandbox. Actually, it looks like every one of the nine applications in the AIR showcase could work within a sandbox if suitable crossdomain files were installed on the servers they need to access.

To show leadership in the security area, I think Adobe needs to provide a secure sandbox for AIR applications to execute in, and take the lead in encouraging the installation of crossdomain files on the public Web sites that they need to access. In addition to taking care of all the showcase applications, it looks like this would cover the needs of the vast majority of the applications on the Adobe AIR Marketplace. Once a secure sandbox is provided, it wouldn't be necessary to insist on signatures at all for applications that run in safe mode in the sandbox, any more than we need to insist on a signature for every Web page that we visit when browsing the Web.

That leaves a small minority of applications that really do need the keys to your machine, such as an application that helps you find the files that are actually taking up all that disk space, or applications that roam your file system looking for pictures to process, upload, or burn onto a DVD. Every major-league software manufacturer in the world today provides signed installers, using real, verifiable certificates, to authenticate the authorship of their installed applications, and I think that is the appropriate standard of verification for installing applications that will have that kind of access. In today's era of viruses, Trojans, and rootkits, any new platform for serious application development and distribution should insist on nothing less.

Curl has for a long time supported both safe (sandboxed) and privileged execution modes, running both inside and outside the browser. With our recent Curl Nitro announcement, we have added packaging so that out-of-browser applications can be installed with desktop icons and start menu entries, but we still provide a safe sandbox for these applications and we insist on a verifiable signature for any application that needs access to run outside of the sandbox. We believe this is what every credible platform for Web-deployed desktop applications needs to do.

Aug 22, 2008 5:12 PM

Daniel Rosenstark says in response to Bert Halstead:

It's obvious what the problem is -- that no security is provided -- but the exact same thing happens if I distribute a Java app via Webstart (or via download, like my www.confusionists.com/handsonic) or if I distribute a .Net app (as I do with www.thekbase.com). What would be the "first publicized exploit?" You mean, a malicious application?

My question is, what kind of solution do you want? Most users who have a personal firewall installed say "yes" to every access request, because otherwise STUFF DOESN'T WORK. There is no simple answer to this. Imagine an app that says, "this so and so app wants to delete some stuff from you /opt/whosit directory. Is that okay?" How should a user respond. As computers are being used by more and more people, more and more people do not know what their filesystem looks like.

A real solution -- for AIR, like for .Net or Java or native applications -- would include some kinds of security levels or something (i.e., the sandbox would have to be comprehensible to the end user). But what would it require of the user? What kind of user would be able to benefit from it?

We have all types of malware because OSes (and VMs) provide a service, which can be used for evil as well as good. Security is really really hard stuff to do, because we want our OS or VM or whatever to continue providing a service. Critics are everywhere but solutions that are viable for the masses are few.

Excuse my naivete and getting to the conversation late. I'm just thinking of using AIR for my next app and happened to have found this thread.

Aug 23, 2008 3:31 AM

Richard Monson-Haefel says in response to Daniel Rosenstark:

Daniel,

Your response is well reasoned and you are right: there are certain applications for which you need a native installation. However, this is not the case for all applications or even (I would argue) most applications.

Take the application you are developing as an example. Does it need full system access; is it necessary for the application to be able to access your entire hard drive? Does it need to be able to connect to arbitrary ports? Start arbitrary processes? Probably not. Most applications don’t. Yet, this is the kind of functionality made possible by native installations, which is the type of installation you get with Adobe AIR.

Imagine a world in which native installs are the exception, not the rule. Where most applications could not access your entire hard drive, silently open arbitrary ports or start up processes. Wouldn't the world be a safer place for our computers? Our data?

Obviously we are not going to change the world, but we can offer an alternative to enterprises that choose to take advantage of it. Curl offers a platform where it’s assumed that applications don't need system wide access. An environment in which every application your employees use is viewed as potentially dangerous.

If you are an enterprise and you set up Curl, most applications will run without you having to agree to anything because they are effectively innocuous. An application that is completely quarantined from the rest of your system is fairly harmless. Obviously, we cannot protect people from social engineering but we can stop arbitrary applications from doing anything they want after they are downloaded and installed.

We say to our customers: Don't settle for an environment where arbitrary applications can do just about anything to your system. Insist on a safer environment, one in which employees cannot download malicious applications by intension or mistake.

With Curl you can deploy, and users can install, applications that have full privileges to the system, but you have to buy a license to create them (a financial road block to hackers but not corporations) and you have to agree to a pretty scary warning if you want to install the application. In addition administers can block a users ability to install privileged applications or grant permissions for Curl to run specific privilaged applications signed by a known certificate authority.

We can't change the world, but we can make it safer one enterprise at a time. In the end, however, it’s up to each enterprise to decide. Do they want their users to be able to download malicious applications or not? If the answer is "no" than they need Curl as their common runtime for applications. If the answer is "Yes we do want users to be able to install malicious applications" than they can use any solution they want.

I hope that helps explain our position on this issue. We offer a safe environment to run arbitrary applications. Any environment that allows for natively installed applications (including Adobe AIR) does not.

All the best,

Richard

Aug 23, 2008 8:05 PM

peabulls says in response to Richard Monson-Haefel:

a couple random thoughts

as i was reading through the article and associated comments .. i played a little game where every time i saw a reference to Adobe AIR i replaced it with something like Java or .Net .. i found that most of the statements were just a valid with these replacements (Daniel touched on this in his comment) .. essentially the singling out of AIR, in this context, is frivolous. i might have preferred an article titled "Why Criminal Hackers like the amateur software trade" or on a less negative note "Why Criminal Hackers hate curl" .. it seems like that article might have better addressed the issues inherent in our current software distribution model and even possibly offered some solutions for both future software developers and developers with large existing code bases or other extenuating circumstances that prohibit them from changing development environments.

now there are 2 conflicting dichotomies that make the above topic difficult to discuss ..

firstly, we have "Casually loaded Internet gadgets" vs applications that need system access .. (for the sake of this discussion we will pretend that there is no area of gray between these two) .. I think most would agree that the gadgets have absolutely no need to run outside of a secure sandbox of some kind .. I personally would agree that most applications don't need any more access than those gadgets do .. but that leaves us with applications than need system access ..

which bring us to our second dichotomy .. professional software vs amateur software .. a company, in the case of the type of application that needs system access, can do the whole signed application / certificate thing to prove their software is 'legitimate' .. but a weekend developer, just trying to get his/her stuff out there for people to see probably doesn't have the cash (or desire to spend the cash) to 'verify' their software .. i understand that an end user can still download and install this software if they "agree to a pretty scary warning" but ..

a company that i was working for allowed users to place links to external sites on their profile .. now obviously, within the first week some malicious users took advantage of this to redirect naive users to password mining copies of our login page (despite copious warnings against trusting links on a users profile) .. so then, every time a user clicked on an external link .. we popped up an alert, notifying the user that he/she was navigating off the site .. (almost no change in the number of accounts compromised in the above manner) .. next step: every external link went to a page where, on a red background, bold text notified the user that they were leaving the site .. (only slightly fewer passwords were compromised)

when you are in an environment that offers both limited-secure and unlimited-nonsecure interactions .. you have to trust the user to apply their better judgment to the situation .. unfortunately, and don't get me wrong .. i love the little scalawags, users don't want to read your important warning message

(as a side note, on the point of signing .. while great for 'man in the middle' hacking .. i feel the need to point out that once, on a lark, a few of my friends and i chipped in on getting a piece of malware properly signed through Verisign.)

ok .. last thing .. then i shut up:

software development is a landscape of ever changing topography .. and right now, one of the prominent features of that landscape is amateur developed applications .. we see this on sites like face book, and in the casual gaming community .. really all over the place .. in the past, the lion's share of our interactions with this 'software' was mediated by a browser, and the sandboxes that come with it .. but this has been changing .. people don't always just want a little freeware gadget or game .. there are applications now .. and some of these applications cannot be run from a locked down sandbox .. and this obviously has the potential to cause a lot of damage .. but it also breaths a lot of new life into the software development community

now we could solve the above problem by creating a solution in a single language, and bullying everyone else into using it .. but even if you could get everybody to agree on your solution .. one of the big reasons multiple programming languages exist is that they all solve for different problem domains .. furthermore, those problem domains evolve over time .. so the likelihood of your solution or language still being applicable (or even existing) in 20 years is pretty low

it seems to me that if we are really intent on making the software world a safer place for users to navigate, we need to focus on a solution that is language (or even context) agnostic .. maybe it's a lightning fast virtual runtime that can encompass any VM and act as an internal firewall who's rules are set by an external team of experts (like modern virus software) .. or some topographical change to the way we build operating systems that separates 'secure' actions from 'insecure' ones .. or even a system that can cleverly trick users into learning enough about how their computer works to make informed decisions when those crazy popups tell them that they have to make some arbitrary seeming choice .. I believe that solution to be Adobe Air .. just kidding .. i wanted to see if anybody was still reading at this point .. to be honest, i have no idea where such a solution might sit .. security isn't my milieu.

-- me

Sep 19, 2008 7:12 PM

Mohan Embar says in response to Daniel Rosenstark:

Hi All,

My knee-jerk reaction to some of the things mentioned:

- Java Webstart applications are sandboxed if they are unsigned so the above statement is incorrect. The same is true of an unsigned .NET executable, it runs just fine in a sandboxed environment until you try to do something like access the filesystem or even obtain a device context for drawing graphics. I don't know much about ClickOnce.

- When you self-sign a Java Webstart application, the runtime issues a strongly-worded warning encouraging you not to run the application if you have any doubts. I can't remember what the exact wording is.

- Similarly, in IE 7, when I use a self-signed certificate to test one of my web applications over https, IE complains very vociferously, gives me a page which looks like the action has been disallowed with a really tiny hyperlink to proceed anyway, then displays a really nasty red background for the URL in the address bar throughout the entirety of my session.

From what I'm reading from rhh, Adobe AIR simply says that the publisher is UNKNOWN. For me the difference in this approach vs. the approach taken by IE and JWS is clear. I don't think self-signed stuff should be disallowed, but the user should definitely be bludgeoned over the head if s/he is about to run it.

Nov 12, 2008 5:23 PM

Bert Halstead says in response to peabulls:

Sorry, I didn't realize until just now that further discussion had broken out on this thread. I agree that amateur developed applications are a valuable piece of the software landscape. I would disagree that AIR does everything that can be done to facilitate secure use of such applications. I can't do much better than to quote from my own April 28 contribution to this thread, where I wrote "there is really no substitute for providing a secure sandbox for applications to execute in. There is no reason why a person should have to turn over the keys to their machine in order to run a Nickelodeon Puzzle application," and you can read the rest of my comments, in context, above.

For amateur developed applications that really need privileged access to your machine, I have no silver bullet to offer. But many/most applications, amateur developed or otherwise, that are linked to the Web don't require privileged access at all, if a properly designed sandbox is available. It's the lack of such a sandbox in AIR that my comments are really addressing. Other technologies, such as Java Webstart or Curl, do provide such a sandbox, and at least Curl's sandbox is powerful enough that a huge range of useful applications can run safely within it.

Nov 17, 2008 1:05 PM

rwizard says in response to Bert Halstead:

I wound up on this thread because I was looking at subscribing to Jott, and wanted to know more about AIR before I let something else get installed on my computer. As a guy who spent 30+years of his life designing hardware and developing software, but who has now joined the ranks of the users, here is what worries me. I see a proliferation of content delivery platforms that are making it ever more difficult to keep your system running, stable and secure. It isn't just the malware/exploitation/security problem. It is the bloated, unstable, unmanageable, target rich environment problem. It is the "I've got so much crap forced on me by third parties that I can't tell if my system is compromised with malware, or just rendered unusable by too damn many content delivery platform bugs and conflicts." It reminds me of the Biblical tale of the "Tower of Babel".

Will I be using Jott? Sadly, no, because I don't want Air shoved down my throat. Will I be installing Silverlight, or any of the other junk somebody is trying to force me to use so they can grab their piece of the content delivery pie? Not if I can help it.

For those of you who are developers, I hope you will do what I did for all those years. Resist proprietary solutions. Be savvy enough to realize that using the latest "bright and shiny toy" isn't in your best interest, or that of whoever you are developing for.

For those who are users, resist the effort to rope you in to one gimmick after another. I do, and I actually can run my system for weeks at a time without a reboot. Can you?

Dec 6, 2008 7:13 PM

Sam says in response to rwizard:

rwizard, I ended up here for the same reason. I started to d/l the Media Player and noticed that AIR would be installed (whether I wanted it or not). Well, I didn't want something 'unknown' so I started looking for info about it. I agree with you 100% (and I'm just an end-user with some certifications, A, Network, iNet+, etc.) I work very hard to ensure that I don't end up with a lot of things on my computer that I didn't d/l or install, and (knock wood) this ol' computer has been running for years and years (too poor to replace it, LOL). Thanks to rhh for your info and to the adobe writer for his/her feigned? transparent? ignorance. Even this non-programmer could see how providing system access to code available to literally any programmer provides system access to literally any programmer. Doh.

Dec 19, 2008 2:21 AM

Sean says in response to Bert Halstead:

Java Web start is not comparable to AIR, they are 2 different ideas. JWS was unsuccessfully marketed as a kindof 'popup plugin' for web pages. If anything, AIR would be comparable to a regular installable java application. Last time I looked, the Eclipse installer made no effort to protect me from installing itself, nor did it sandbox itself in any way. If anything, hackers want nothing to do with AIR because the installation process is more prohibitive then a regular exe/dmg and the lack of executing other applications within AIR is too restrictive.

Jan 2, 2009 3:03 AM

Justin_P says:

The fact that the application has to be installed is a pretty significant "opt-in" on the user's part. Most malware that I've seen doesn't even have to be installed. It's much easier to get a user to run a stand-alone executable than to get he/she to complete an install process that puts an executable into the user's applications directory (which is all an AIR installer really does).

Jan 29, 2009 11:46 AM

blah blah blah says in response to Justin_P:

Look, this topic is retarded.

man in the middle attacks, dns hijacking?

If someone is doing that to your network, Adobe AIR is the least of your worries.

Self signed certificates provide SSL whether as not having them does not.

This is the same as running an application that you aren't aware of who made it. users already do this, that's why viruses spread to begin with!

It'd be better to just restrict the file system when its in the browser and if needed, then "grant" permission for it to access the file system.

yes sandboxed is better, but you are really really making a big deal out of something that isn't.

Regards,

The internet.

Feb 18, 2009 4:45 AM

amar shukla says in response to blah blah blah:

Well Mr. Author,

Can you tell me that when we download any program made in any language like C,C++,Java ,Python , etc .. Do you get any Verisign kind of security certificate with every produt , NO they don't pose certificates but still all of us download them and use them , What if those Apps poses Trojans or malicious code ???

And AIR Apps use limited OS services only , You can't exploit infected system massively .

So Better think thrice before posting any such comment for any technology , specially if you don't know about this .

Mar 13, 2009 1:38 PM

Jimmy says in response to amar shukla:

Amar is the first to say what I've been thinking this whole thread - what do any of these complaints have to do with AIR? The amateur software trade has been around forever, and native applications have the same access to your system that AIR applications do. The risk of giving a program access to your whole disk is nothing new, and nothing specific to AIR. While the commenter from Adobe above wasn't super helpful, I do agree with him that this article is pretty pointlessly inflamatory and never gives a real valid reason why "criminal hackers will love Adobe AIR." The security issues mentioned are all quite generic.

Mar 13, 2009 7:21 PM

Duke says in response to Jimmy:

Yes this is a generic problem for many ways of delivering software, but security is becoming an increasingly important problem. So platforms like Curl are offering ways to provide powerful applications from unknown authors while allowing the user to have some confidence that they are avoiding a security threat. I don't trust amateur software anymore, and would feel more secure if the amateur software was delivered using a platform like Curl.

Mar 22, 2009 12:47 PM

watajoke says in response to Duke:

Can't believe that all this fuss was just to exaggerate Curl's "security" over amateur software by trying to make Adobe AIR a somewhat laughing-stock.

As pointed by Amar, this is very true:

"Can you tell me that when we download any program made in any language like C,C++,Java ,Python , etc .. Do you get any Verisign kind of security certificate with every product?"

As pointed by John Dowdell:

"Your title is incendiary, but I understand how people feel they can get attention by being controversial. It's a sharp sword to wield, though."

Obviously the author just want the article to be controversial enough to be read by others.

Mar 30, 2009 5:32 PM

Bert Halstead says in response to watajoke:

I think there is, and should be, a distinction between Web-deployed applications and "amateur software" written in C+, Python, or any of the other languages that have been mentioned. Would you download and install a C+ application as casually as you would visit a Web page that turned up in a Google search? I wouldn't, and most smart people wouldn't. You would research the application to make sure it seemed to come from a trustworthy source first. Do you do this every time you visit a new Web page? Most people don't.

One goal of AIR has been, as I understand it, to provide a vehicle for desktop applications that you could install with the same confidence you'd have in visiting a Web page. And if that isn't a goal of AIR, it should have been and could have been. My comment is simply that AIR doesn't deliver on that promise for the same reason that C++ doesn't deliver on that promise. Even though all AIR applications are required to be signed, which the AIR publicity has touted as a security benefit, in fact there is no actual security gain over the C++ or Python story.

But there could have been a security gain if AIR provided the ability for correctly sandboxed execution of unprivileged applications. Flash provides this kind of sandbox, but not for desktop applets. Curl provides this kind of sandbox for both desktop and browser-embedded applets. I think AIR would have made a great contribution by providing such a sandbox, but the opportunity was missed.

I guess the argument that my title was incendiary rests on believing that nobody would be stupid enough to think that an AIR application is any safer than a C++ application, despite Adobe's claim that AIR is different and better than platforms like C++ because all AIR applications must be signed. But if that's true, it's a pity because it didn't need to be that way -- AIR could have been better.

Apr 14, 2009 1:58 PM

ubermonk says in response to Bert Halstead:

The problem isn't the development platform, neither really the type of application. The main problem is the end user. You can create malicious software in nearly any platform, and distribute it any way, bit at the end of the day it's the end user who chooses to install apps that are unfamiliar to them without doing the proper research first.

Let's face it, most end users don't know any better and therein lies the cruz of the problem. Ask the typical net user what a digital certificate is, what a sandboxes environment is, or anything like that that experienced users might know about and they will look at you confused in the face and shrug their shoulders.

The best security is education. If the end user is educated in security issues in a language they can understand, then they can be expected to make an informed decision or wether or norlt they can risk running a piece of software, whether it accesses the filesystem or not. In the end, as unfortunate as it is, end users are generally idiots and won't change until they are educated in these issues.

Apr 14, 2009 2:03 PM

ubermonk says in response to ubermonk:

Btw, sorry for typos. Using iPhone and it's bloody annoying autocorrect feature.

May 21, 2009 9:44 AM

TGoodin says:

Thank you for such an informative post!

I was actually doing my due diligence, trying to figure out what exactly AIR was, when I came across your Blog.

While reading the whole conversation from the disingenuous Adobe spokesperson? cronie? whatever, A recent client of mine comes to mind. This guy brought in his badly infected computer (Win XP) and asked me to 'fix it'. He was using it as a backup machine to support his activities on Ebay, and apparently, some casual browsing, as well. HUTU comes to mind here.

So, I downloaded and installed a fairly decent free virus scanner, and cleaned up his 'infection'. Two days after I gave it back to him, this client was on the phone complaining he couldn't get the mouse to work! - any bets here?

On investigating this issue, I found that his computer was so infected with viruses that the pointer would not move at all, in response to any mouse movement. Further I found that the virus scanner had not been disabled. At this point I started digging thru IE's temp directories - I wanted to know where he'd gotten into trouble. It was a website that, by he time I visited, it had been taken down for distributing malware.

Here's how it happened, as near as I can tell: My client was browsing the web with his newly repaired PC, and came across a site with some sort of attention getting link - perhaps blue/red blinkies saying "Your computer might be at risk! click here for a FREE scan of your computer!" said link then installed some piece of malware that disabled or modified the virus scanner. It then infected his computer with viruses, trojans, and rootkits (oh my!) or a subset of the three.

But the lesson here is not just how a 'moron' can screw up his computer in the click of a mouse button. It's that, while there are quit a few tech savvy computer users, that know to ask questions when things don't add up, there are users that have no clue that there is a class of programmers out there that will stop at NOTHING to gain access to their computer, or cause trouble.

Of course there are other lessons that could also be learned - like that all virus scanners are NOT created equal, or that 'that tech guy down the street might be great with Linux, but still can't pick a good virus scanner to save his life' ( a scathing self critique).

One more lesson that some might do well to learn - Linux still doesn't get 'infections', so why would I invite any application to execute arbitrary code, and poke a hole in it's security? AIR for Linux - no way!

Jul 31, 2009 5:36 AM

Charles K says in response to Richard Monson-Haefel:

Richard, Thanks for the 'straight' common sense. I spent allot of time dealing with what I have to see now as a 'victim'. Have been desperately needing full use of my computer to find a job and access years of machining 'portfolio'.

I've been a CNC Programmer over 30 years; no doubt it was allot easier back in the days using an IBM 370 or even a PDP-11; either mainframe used as a 'tool' to focus on the task, reducing workload and improving life with more leisure time. Now it seems my lesiure time is spent prying 'Corporate greed' out of my computer (ietoolbox) so I can improve current situtation that is more their fault than mine.Is it just me.......? Was getting frustrated now I'm ___. What follows is email to some my 'contacts' as a 'heads-up' and a 'lampoon'. Final draft is going to My Congressmen. They've lost me; Adobe will be replaced! Charles

Damn, I spent all day 'cleansing' my 2000Pro desktop!! Over the last month, I've been faced with a steady decay in oper system stability, processing speed, and website functionality. Unusual Memory dumps, system freezes, file corruptions, loss of website and server connects...... all looming with much greater frequency.... First thing I recall noticing was some 'major' websites that I visit on a daily basis were oddly varying in appearance and format; were missing 'scripts' in now blank fields and had their usual navigation links
unreactive or absent.............Even Firefox 3.5 started crashing regularly ... Without any real apparent cause I vaguely assumed that recent website modifications had been implemented to enhance the 'Vista' users experience and were non-compatible in a Win2000 environment .........OK, Don't ask me why I'm still using 2000 in response to requests for IT help I've posted! Just call me a dinosaur, punk!
I was just about to re-format boot drive and change over Oper system to XP-Pro when repeatable 'crash' of any .PDF file was observed upon scroll to next page regardless of ..........OK, What is 'jacked' with Adobe Reader that is common to both web and local drive .PDF files??? I Found the 'Rat'. About a month ago, I casually updated Adobe Reader from 9.0 to 9.1. using Adobe's website....Well, true to various critical complaints raised about their pricing policies ( see Wikipedia "Adobe Systems-criticism") and manipulative practices of implementing software platforms that are more focused for their and their corporate client's 'revenue generation' (BY DESIGN) then they are a useful application to the 'sucker' end-user.
That RAT's name is ADOBE AIR (now auto-loaded with only 9.1 'update' to Adobe Reader made available).
From: Wikipedia "Adobe Air" ......a rich Internet application deployed in a browser does not require installation, while one deployed with AIR requires the application be packaged and installed to the user's local file system. However, this provides access to local storage and file systems, while browser-deployed applications are more limited in where and how data are accessed and stored.

Adobe AIR 1.1 was released on June 16, 2008, and provides support for building internationalized applications. Runtime installation dialogs were localized to Brazilian Portuguese, Chinese (Traditional and Simplified), French, German, Italian, Japanese, Korean, Russian and Spanish. In addition, version 1.1 includes support for Microsoft Windows XP Tablet PC Edition and 64-bit editions of Windows Vista Home Premium, Business, Ultimate, or Enterprise. (I know it doesn't support 2000, learned the hard way!!!)

AIR applications can operate offline, and then activate further functionality or upload data when an active Internet connection becomes available. One example is eBay Desktop, That's called a "TROJAN HORSE": %^$%&^%*( Honey, get my ______ )

SEE:/blogs/community_blog/2008/04/16why-criminal-hackers-will-love-adobe-air

Sep 7, 2009 7:13 PM

B says in response to Charles K:

Charles K... WTF???

Curl Blog

Why Criminal Hackers Will Love Adobe AIR

Post a comment

Actions

Recent Comments

Popular Blog Posts

Recent Posts