An issue, previously fixed by Adobe in October 2011, has reappeared in Google Chrome and allows attackers to take control of webcams and microphones from Flash content. At its heart the problem is an old one: click-jacking.
The trick places a transparent Flash animation panel over an image and then makes the permissions dialog for accessing the webcam and microphone appear. All that is then needed is to convince the user to click on the right part of the image. In security consultant Egor Homakov's proof of concept this is done by using an image which suggests a possibly risque video is available for viewing and placing the play button where the "OK" button on the permissions dialog has been positioned. (more)
