Flash

http://ashkansoltani.org/docs/respawn_redux.html

http://ashkansoltani.org/docs/respawn_redux.html An article that describes a method to create a permanent cookie based on If-Modified and Etag HTTP headers. Currently this is used in “the wild” by several banner and add networks. The method is possible because of the simplified implementation of If-Modified implementation in all modern browsers (browsers do not validate values of if-Modified as DATE)

https://bugzilla.redhat.com/show_bug.cgi?id=638477 Fedora glibc guys broke a flash player for Linus , with, (tada!) a “optimization” of memcpy().

http://www.ietf.org/proceedings/10mar/slides/tsvarea-1.pdf “secret of ChatRoulette”. Describes details of RTMFP protocol, that Flash Player (from v.10.1 and above ) uses for media delivery. Protocol is closed/proprietary, encrypted, UDP-based, uses “forward” servers to establish direct session between the nodes. It is not clear if C&C; structure is distributed.

http://code.google.com/p/red5phone/ untested. just something to watch for.

http://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/ detalied description about Flash vuln that was used to vin a recent hack contest (where vista and mac were hacked )