Spycam vulnerability reappears in Google Chrome's Flash

An issue, previously fixed by Adobe in October 2011, has reappeared in Google Chrome and allows attackers to take control of webcams and microphones from Flash content. At its heart the problem is an old one: click-jacking.

The trick places a transparent Flash animation panel over an image and then makes the permissions dialog for accessing the webcam and microphone appear. All that is then needed is to convince the user to click on the right part of the image. In security consultant Egor Homakov's proof of concept this is done by using an image which suggests a possibly risque video is available for viewing and placing the play button where the "OK" button on the permissions dialog has been positioned.

Whether the trick works depends on how the browser handles Flash Player elements that are marked to be transparent. The original discovery noted that Firefox 21 and Opera ignore transparent Flash, drawing it opaquely so the panel is visible and the trick does not work. But on Chrome 27 and, allegedly, IE 10, the transparent area is invisible (100% transparent) and the user can be tricked into clicking on the transparent area and whatever controls are there.

Adobe told The Register that the issue is something Google has to fix and that the company is expecting to release a patch this week. The trick does require user interaction and it does not prevent the LEDs that usually come on when the camera is live from lighting up.

(djwm)