[F8] loading image from PHP securely

Hi,

any ideas on how to load JPG picture into FLASH without revieling its location and preventing the access to load this JPG without FLASH?

so far I've managed to call LoadMovie('picoutput.php?id=picid'). It sure hides the physical .JPG location on the server, but you can still see the request going to picout.php with all _GET parameters (by using URLHelper or any other traffic request analyser program) and then you can hack and get the picture out in browser directly by executing picout.php URL bypassing FLASH!

In my example FLASH together with PHP are ment to play the picture protector role which doesn't allow the picture to be loaded in any other way than only in FLASH!

maybe somebody have any ideas how to do that?

You could try LoadVars and switch to the POST method (but you will have to update PHP script). Least I have never noticed this method revealing anything.

yes, I thought about that already!

the idea is simple - viewer receives mail with the access URL which is something like:
www.mydomain.com?view.php?access=xxx

entering this URL in the browser - it loads a page with the flash embedded and access key passed to it!

Then I think flash should generate some MD5 variation from the access key and request the picoutput.php with two POST parameters: 1) access key, 2) MD5 modified access key.

picoutput.php receives two POST variables and checks if they match (knowing the same algoryth how second parameter was generated by flash)

if everything is okay - it outputs the picture, otherwise - no!

The only problem is that Flash can be hacked and reversed back to actionscript code and the second parameter generating algorythm discovered! Any experience with securing actionscript code?

Or any better ideas in general?

Well As far as I know, flash does not have and MD5 capabilities, thats a PHP thing. I suppose you could take the key into flash, send that key via load vars to another PHP page that encrypts it and returns it to flash and then use the encrypted key to call the image. So even if they decompiled the SWF, the encrypted value itself would not be in the code.

I found the md5 implementation for flash already!

but, with the second php file execution - again the same problem - how to ensure that it gives output only when called from this particular flash application!?

Humm this looks like it may be a catch 22. Perhaps some of the other users here will have some ideas.

hi put the pictures path into a database field then pull it out using php then pass it into flash as an encrypted string....you can encrypt the string easily using mysql....php can extract the string and even insert it and upload a picture.

Did work a little on this issue some time ago.
There appears to be no way you can make Flash secure, because anything you put in it can be easily accessed and re-used.

So any kind of key or method that "only your flash movie" would use to access the PHP service, can be replicated.

There is no apparent solution to this problem.. you can make it slightly more difficult for people to access your content, but not impossible.



Remember that Flash sends specific request headers (some of which can be customized), so you can use that too for filtering requests.

Sorry dude...

p.s. In any case if you merge user authentication, secure connection and randomic encription, you can't avoit people from building their own tools to access your images, but you sure will know that whoever accesses the images is a registered user.

sure, i understand, that there's no bullet proof solution and everything can be cracked and hacked to get what you need!

therefore I am still searching for the best possible way and combination of PHP and Flash to get the most out of it!

Basically take in account that the more intelligence you move on the server, the more you can secure transactions.

You must think of Flash as a very simple item in the website-to-user interface.
All of it can be replicated easily in JS, VBS, Java etc... so don't stick to much to Flash..

here are some things you can do .

1. create variables using a random number.....random(2000);
2. search strings looking for a certain combination of characters such as .jpg....png etc
don't allow the script to continue to execute unless the proper characters are found

3. encrypt all data outside flash using php or other encryption software before pulling it into flash.
4. create a secure directroy for all your php pages...then use include or include once statments to pull your php into any html pages you are using.
5. secure the directories that contain you .swf and use html not java in your html pages to pull in the .swf

Use loadvars and php session variables to store data or server side actionscript using flash media server

bullet proof no .............better than nothing yes!

@calmchess:

1. you know that random() is deprecated, and is not a true random function?

2. why should you not use scripts to load Flash content into the HTML document? you aware of the EOLAS issue in IE?

thanks for these bright ideas!

keyone, could you describe the second option more detailed?

I'm not critizing anybody I'm sure there are other security considerations to be taken into account and iplemented.....plz share any security thoughts or tactics that you possess......I'm always learning.

Well basically Bill Gates has been slapped in the face by people he stolen code from.
Thus Internet Explorer is no longer capable of loading ActiveX media directly from the markup: it must be printed in the document dynamically (from any kind of script).

You can find all sorts of fixes, but a very good practice is to use the acclaimed swfObject script, that does all the dispatching stuff and loads the content in place.

If you need to find info on this subject, google "EOLAS FIX" and "SWFOBJECT".

Ciao ;)

Hey Calmchess, if I appeared to be harsh or rude please forgive me, that wasn't my intent. I'm just stuck at work with too many open windows and sometimes I cut the conversation to the bone!

I was just pointing out two issues in your answer, not for anything but to illustrate and discuss further.

well If random is deprecated then I say don't use it in a production script but it will still work wonderfully to make random variable names which will be difficult to guess even if all the script does is produce a list of variable names which have to be cut copied and pasted.....as far as not using java script I say that because some people turn it off for security reasons therefore it might not load if thier java is turned off ... its also well known that java can be used to exploit an inproperly secured pc or server. so no to java yes to native flash or html way of embedding .swf into webpage.

calmchess - could you describe the random number idea a bit more detailed? i think i am still missing the point with random variable names

sure

1. a flash page could potentially be reconstructed if the variable names can be easily guessed....the same holds true for php............probably isn't a huge concearn though unless you are building flash that launches military missles or some other government mind control program(just a little humor)

2. using a random number/name for a variable helps to keep your flash variables unique and from coflicting with each other.

you mean those variable names that are being passed from php to flash and vice versa?
still trying to catch the idea...

all variable names should be unique,complex,and random for maximum security in both php scripting language and flash actionscript language....for example.....

Code:

---

xdx302 = "secure varible name";

---

Code:

---

secure= "this is a secure login variable name but isn't all that secure for a variable name because it can be easily guessed";

---

okay, got it! sure! :)

one more thing when echoing php variables to be pulled into flash don't let the page contiaining the echoing script to be seen by the user just tell LoadVars to point at the php file that way the echo is never seen in the users browser.

the question is, how to identify that php file was requested by flash? and not entered by user in the browser window?

Well, calmchess I think you are confusing Java and Javascript. They are two very different things.

Javascript is pretty limited and doesn't offer many ways to exploit the client's environment.
Today it's unlikely to find users with deactivated JS, because it is complementary to most websites.
It is more likely that you deal with handheld, or other kinds of, devices that aren't JS capable.

In any case swfObject follows good guidelines for graceful degradation.
The way you use it works so that if client is Flash capable, it delivers Flash... if the client is only JS enabled, it delivers alternative content (that might be the Flash installing page)... if the user isn't even JS enabled, the original markup is shown.
Such markup can be designed for graceful degradation too: an XHTML markup with CSS style will deliver it's contents with full aesthetics if the client is capable. In case the client is not CSS capable, or is set to display text only, the webpage will be displayed as simple hypertext, in a user friendly way.

The Flash detection kit maybe closer to your view: the JS doesn't just stick a Flash object to the HTML tree, it does in fact read the Flash object from the HTML tree and overwrites it with itself.
This way if the client has disabled JS, it will still load Flash if it's capable (like in the old days).
I don't like this solution because the code isn't elegant, but from an accessibility point of view, it is better.


Regarding the random() function, if you press F1 in Flash, and type "random", you will be presented with useful info and guidelines for a correct use of it's successor, for example like this:

code:

---

function rand(a:Number, b:Number):Number {

    var min:Number;

    var max:Number;

    if(!b) {

        min = a;

        max = b;

    } else {

        min = 0;

        max = a;

    }

    var randomNum:Number = Math.floor(Math.random() * (max - min + 1)) + min;

    return randomNum;

}

---

The script above gives you the ability to use the new method just like the old one:

code:

---

//to get a random number between 0 and 5

var randomNumber:Number = rand(5);

---

or to use it in a more customizable way:

code:

---

//to get a random number between 1 and 6

var randomNumber:Number = rand(1, 6);

---

This needs to be done because the new method (Math.random()) does not accept any arguments and returns a number between 0 and 1.
More precisely if x is the returned number: 0<=x<1.

well yes your examples are actual script and what I meant by using the random number to create a random variable name ......you can use it to both generate random numbers and text strings and there is a loop that I have that can also accomplish a random number/string.............also I can think of at least 3 diffrent ways to get information about a users computer using javascript right off the top of my head such as what browser they are using their IP address....where they have been set a cookie..redirect their browser .....lots and lots of potentially nasty stuff using javascript.......millions of ways with php!

calmchess, what you refer to as "nasty things" is the basics about which the whole Internet is founded on.

Public IP address (which is a public datum in fact), cookies, the ability to redirect... these are all inoffensive tools.

Ok, back in Web 1.0, you could place an onclose event to reopen a page when it is closed. Crap like that is still possible, but doesn't prevent the mass from accessing the web like they should do!
They just won't go back to the lame sites..

well I'm done arguing about it I'm just pointing out stuff that makes some people nervous.....I will say though that I think implementing no java is a little paranoid and should only be disabled by those that have truly secret or sensitive information to protect.

Yeah but people are scared of Internet as a whole.
Common user needs an anti-virus software because is too stupid to not execute unknown files that some lame website tricked into downloading....
come on.. anti-virus is totally useless for power users!

What I don't understand is all the fuss about Javascript. If you look at the stats, you will notice that users without JS or with JS disabled are really few.

Whatever depth your work will require, you must always keep in mind the no-JS users, but mostly to tell them to turn the darn JS support back on! ;)

well I'm glad we found something we can both agree on .....*shakes hand*

dude, no arguing.. just discussing!
In the end, this is a discussion board ;)

Take care