“SWFTools is a collection of code for handling Flash .SWF-files. This includes a
merging tool (swfcombine), an extracting tool (swfextract),
PDF/JPEG/PNG/AVI/TTF/WAV to SWF converters (pdf2swf, jpeg2swf, png2swf, avi2swf,
font2swf, and wav2swf), a text parsing tool (swfstrings), an SWF parser
(swfdump), and a library for writing and reading SWFs (rfxswflib).”

http://freshmeat.net/projects/swftools#release_317771

Mike Chambers has an additional piece as well from his own testing:
Relative Performance of Rich Media Content across Browsers and Operating Systems (does not ‘perform consistently worse on Mac than on Windows’).
http://www.mikechambers.com/blog/2010/03/01/relative-performance-of-rich-media-content-across-browsers-and-operating-systems/

This is a bit of an old article, sorry but it managed to not get published when it was supposed to.

I’m keen to have a mooch/play around under the hood, hopefully I’ll be proved wrong. The current Apple App submission process is far from being a smooth and easy process, it’s slow and cumbersome and communication is poor. Now add in iAds to the mix… and what if Apple don’t like the ads we’ve submitted, what if they don;t meet their exacting criteria? Only time will tell. And lastly…

And lastly, Apple are demanding 40% of revenues, which seems rather high.

Update: 2010-04-13 17:18pm – Here’s some links to related articles as the story unfolds.
Apple to Lend Hand to iAd Producers [AdAge]
Apple iAd Platform: A Case of the Rich Getting Richer [PCMag]
iAd for the Win as iPhone 4′s Biggest Blockbuster [Macnewsworld]
Is Apple Trying to Create a Mobile Ad Monopoly on the iPhone? [148apps]

The latter article deals with a clause in the Developers agreement that states:
Section 3.3.9:
…the use of third party software in Your Application to collect and send Device Data to a third party for processing or analysis is expressly prohibited.

In the past we used, and still do, tools such as Sothink SWF Decompiler and URLActionEditor to analyse flash files and amend them accordingly. But enter OneVision wo’ve been busy in the intervening years and by all accounts have built out a fully-featured pre-flighting tool called Contenio for use by online AdOps departments to check and authorise creatives as they come into the department. I haven’t yet seen the product working but I’m hopeful it will address some of the ore recurrent themes such as checking for clickTag() case sensitivity/spelling, fix _root. issues, check for embedded urls, check for target=”_blank” etc, but hopefully we’ll get to see this in action soon and report back our findings.

For those of you trying to automate out your QA process this could be of vital interest. I look forward to speaking to someone who’s currently or planning on working with this soon.

This on the back of this report:
http://www.theregister.co.uk/2009/12/22/mass_flash_file_vulnerability/ and http://websecurity.com.ua/3789/

My personal take on this is that yes, it could be used as a potential XSS but invariabaly it would have meant that the original 3rd party adserver had been compromised anyway… which is a much more serious issue, eg;

OpenX Ad Server reported to be hacked [2009-12]
Hackers hit OpenX ad server in Adobe attack [2009-12]
eWeek Web Site Leads Users to Rogue Anti-Virus (AV) Application [2009-02]
Details of hijacked 24/7 ad server emerge [2007-10]
Hacked Ad Seen on MySpace Served Spyware to a Million [2006-07]
Bofra exploit hits our ad serving supplier [2004-11]

It’s full list of threat predictions include:
McAfee Labs foresees an increase in threats related to social networking sites, banking security, and botnets, as well as attacks targeting users, businesses, and applications. However, in 2010 we expect to see an increase in the effectiveness of law enforcement to ight back against cybercrime.

• Social networking sites such as Facebook will face more sophisticated threats as the number of users grows.
• The explosion of applications on Facebook and other services will be an ideal vector for cybercriminals, who will take advantage of friends trusting friends to click links they might otherwise treat cautiously.
• HTML 5 will blur the line between desktop and online applications. This, along with the release of Google Chrome OS, will create another opportunity for malware writers to prey on users.
• Email attachments have delivered malware for years, yet the increasing number of attacks targeted at corporations, journalists, and individual users often fool them into downloading Trojans and other malware.
• Cybercriminals have long picked on Microsoft products due to their popularity. In 2010, we anticipate Adobe software, especially Acrobat Reader and Flash, will take the top spot.
• Banking Trojans will become more clever, sometimes interrupting a legitimate transaction to make an unauthorized withdrawal.
• Botnets are the leading infrastructure for cybercriminals, used for actions from spamming to identity theft. Recent successes in shutting down botnets will force their controllers to switch to alternate, less vulnerable methods of command, including peer-to-peer setups.

PDF report here: http://mcafee.com/us/local_content/white_papers/7985rpt_labs_threat_predict_1209_v2.pdf

Related Slashdot Article: http://it.slashdot.org/story/09/12/29/1435259/Adobe-Flash-To-Be-Top-Hacker-Target-In-2010?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+Slashdot/slashdot+(Slashdot)
Anothe realated article: http://www.itjungle.com/tfh/tfh010410-story09.html

Recently I’ve been looking at ways we can programmatically analyse ad file types and then test them against agreed standards. This will be for GIFs, JPG, PNG and more importantly SWFs. However, SWF decompilation can be a tricky beast and I plan on delving into the more in-depth in a related article but for the meantime here are a few tools that can accomplish it that we use ourselves. So lets begin:

SWFTools: [http://www.swftools.org/]
SWFTools is a set of command-line utilities for interacting with Flash files on the server. They provide the ability to create and decompile flash units and as they are on the command line means that web-services are able to interact with them, meaning you can build your own web-tools or incorporate them into back-systems you may have built in-house. I’m not going to delve into how to use this tool here just yet but I will go about showing you how, given shell access to your hosting account you should be able to install these tools locally.

The quick answer to getting this up on your account is to amend the ./configure line to include a –prefix=/home/UASERNAMEHERE/swtoolsinstalldir I’ll cover this in full below.

The SWFTools FAQ details standard installation as:

tar -zvxf swftools-0.x.x.tar
cd swftools-0.x.x
./configure
make
make install

This would fail on Dreamhost accounts as the make install requires root access which you’re not going to get top be honest. But never fear, this is easily circumvented without putting security at risk. The key here is to not try and install this on a machine-wide basis, that is create your own instance this program locally to your account.

• Create a directory called swftools in your home directory
• chdir into this directory and download the required tar.gz [At time of writing this was http://www.swftools.org/swftools-2009-08-24-2042.tar.gz]
• untar/unzip this to that dir
• chdir to the the folder this has created
• run the nromal installation script but change the ./configure line to “./configure –prefix=/home/USERNAMEHERE/swftools/” where USERNAMEHERE is replaced by your username
• complete the rest of script as detailed in the FAQ
• after this is installed change up a directory and remove the source files and directories

I’ve written this out a single list of commands here, remember to change the USERNAMEHERE to your account username.

cd ~/
mkdir swftools
cd swftools
wget http://www.swftools.org/swftools-2009-08-24-2042.tar.gz
tar -zxvf swftools-2009-08-24-2042.tar.gz
cd swftools-2009-08-24-2042
./configure --prefix=/home/USERNAME/swftools
make
make install
cd ..
rm -rf swftools-*

And that should be that To verify your installation do the following:
~/swftools/bin/swfdump -V
You should get back a response along the lines of
swfdump - part of swftools 2009-08-24-2042
If that’s there then Bob is your proverbial uncle and you’ve successfully managed to install SWFTools, well done.

NOTES:
When I configured my SWFTools I got one error:
checking for missing libraries... ungif gif_lib.h
***************************************************
* The following headers/libraries are missing: ungif gif_lib.h
* Disabling gif2swf tool...
***************************************************
Which means I don’t have access to the gif2swf feature, but that was not needed for my purposes. When I work out how to fix this I’ll post this fix back here as well. Have fun and please post back your successes and any interesting tolls you’ve created from it… happy coding.

http://support.brightcove.com/en/docs/ad-specifications-video-ad