I'm only theorising, but presumably the clickjacking technique is making a flash movie 1% opaque and floating it around the page with javascript such that a malicious movie with the camera-access-granting button is always under the mouse pointer. So the first click the user makes (that they think is clicking something else) will open the camera stream.

I'd hope that the Adobe fix is to popup a new window with settings in rather than showing the settings in the swf context.

If that's the case then Adobe's workaround won't work at all. Just because you set the settings to always deny doesn't mean that a developer can't bring that settings panel back up. The only case that Adobe's workaround works in is if somebody has allowed a particular site to always have access to the cam/mic.

I agree with you, the flash player needs access to the browser itself to bring up it's own little window.

The reason it doesn't seem to make sense is that it's being spun as a Flash flaw.

Bottom line: Browsers can't assure click integrity... slide a DHTML panel atop something, and people think they're clicking an innocent link when they're actually clicking an evil link. Nothing really new. But combine it with Web2.0's promiscuous use of third-party content, and you've got a new problem.

What's worse, the commercial headlines are all copying each other on the Flash angle, solely because Flash can do things (like webcams and mics) which browsers cannot. It's a browser flaw which hides an actual click on the Player's permission dialogs.

It's one thing to bash Flash. But if revenue-grabbing news services focus on Flash, they'll be missing the real problem. When you think about it, there's a secondary security vulnerability in the news services themselves: instead of "look here click there", it's "look here think there". They're off-target, misleading people, causing damage of their own.

More at weblogs.macromedia.com/jd. If ya'll could help spread the word, I'd really appreciate it, thanks.

jd/adobe

@Graeme: The "workaround" sets the settings panel to never appear, even when programmatically triggered by the developer.
See the text in point 4 on the Adobe page, and the text under the "always deny" button.

ahh.. yes of course. You are correct and I stand corrected. When the confirm checkbox is checked it will never come up again for all domains when done from the Adobe site. Thanks for pointing that out to me, I should have just read it all properly in the first place.