Google Chrome's Flash has spycam vulnerability

A problem fixed by Adobe in October 2011 has now surfaced in Google Chrome. The flaw allows attackers to take control of webcams and microphones from Flash content. This is an old problem called click-jacking.

A transparent Flash animation panel appears over an image and then makes the permissions dialog for accessing the webcam and microphone appear. All that is needed then is to convince the user to click on the right part of the image. In security consultant Egor Homakov's proof of concept this is done by using an image which suggests a possibly risque video is available for viewing and placing the play button where the "OK" button on the permissions dialog has been positioned.

The trick works depending on the way the browser handles Flash player elements marked to be transparent. Firefox 21 and Opera ignore transparent Flash, drawing it opaquely so the panel is visible. However, on Chrome 27 and IE 10 the transparent area is invisible and the user can be tricked into clicking on it.

Adobe told The Register that the issue is something Google has to fix and that the company is expecting to release a patch this week. The trick does require user interaction and it does not prevent the LEDs that usually come on when the camera is live from lighting up.