Welcome!

ColdFusion Authors: Dmitry Sotnikov, Maureen O'Gara, Yakov Fain, David Strom, Elizabeth White

Related Topics: Adobe Flex, AJAX & REA

Adobe Flex: Blog Feed Post

Security Soapbox – Decompile Flash/Flex

I always stress the importance of securing proprietary information
By Rob Rusher
Article Rating:
June 26, 2009 10:15 AM EDT
Reads:
 1,791

Having built/architected/developed/consulted many Adobe Flex applications and being one of the first certified Flex instructors in the world, I’ve seen a lot of Flex applications. Some good, some bad.

But no matter how many applications or who I’m talking to, I always stress the importance of securing proprietary information. By securing, I mean don’t put it in your application. Unless your are encrypting your application and decrypting at runtime, you are subject to a decompiler exposing your secrets.

There are Flash decompilers that will take any SWF and give you the source:
Trillix Flash Decompiler is one of the best commercial tools I’ve found.
I’ve even seen guys decompile, make changes and then recompile a Flex app. This is scary! Say goodbye to licensing software in Flash.

But HP just released a tool that has caught my eye as well. (Note: I have not tested this tool) It claims to decompile and test for security weaknesses. It’s called SWFScan and it’s a free Windows based tool from HP.

If security in a Flex or Flash based application is a concern for you, you must look at these tools. If security is not your concern, look anyway.

Read the original blog entry...

Published June 26, 2009 – Reads 1,791
Copyright © 2009 SYS-CON Media, Inc. — All Rights Reserved.
Syndicated stories and blog feeds, all rights reserved by the author.

More Stories By Rob Rusher

Rob Rusher is an Adobe Certified Expert (ACE), Community Expert, and Certified Instructor (ACI). In his role as Principle Consultant for On3, he leads an Adobe software enablement practice to help his clients build rich Internet applications and to rapidly increase their knowledge and skills to better support their organization's goals. He has taught and mentored the technical teams at Standard and Poor’s, eBay, IBM Global Services, the Social Security Administration, and other Government and Fortune 100 organizations.

Because of his depth of knowledge and long standing relationship with Adobe, Rob was selected to write the Certified AIR training course as well as the ColdFusion and Flex certification exams. Rob has also co-authored four best selling books on building secure, cutting-edge and rapidly developed applications using Adobe AIR, ColdFusion and Flex. He is also very active is organizing and speaking at Adobe conferences and user groups. In addition to growing his software consulting practice, On3, Rob has been building expertise in rich client application development on a wider variety of devices and platforms that extend the applications to change the way we all create and live.

On3 provides consulting, mentoring and training services to help organizations grow their own experts from within. For more information, visit us at www.On3solutions.com. Rob Rusher maintains a weblog devoted to Adobe Flex and other Internet technologies at www.RobRusher.com.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.