Supporting Legacy Flash Applications Through Kasm Browser Isolation
By: Justin Travis
Tags: Information Technology, Application Security, Information Security, Software Development, Flash

We have reached the end of the road for Adobe Flash. As described in 2017, Adobe will be ending support and updates for Flash December 31st, 2020. While once a dominant technology in the delivery of web content, flash has been replaced by native industry standard browsing technology such as HTML5, WebGL and WebAssembly.

In addition to ending support for the technology, Adobe is working with technology partners to coordinate an end-of-life: Google, Microsoft, Mozilla, Apple, & Facebook.

This means that your OS…and more specifically, your web browser, will stop supporting flash playback soon (Or already has). As with most things in life, there are good things and bad things about this transition:

Good News:

Increased security and performance in modern browsing technology

Most content providers and applications have already transitioned

Bad News:

Some legacy applications for specialized activities have yet to be re-written and will only be accessible via flash.

Some content providers, such as vintage games and animations may not transition.

Knowing that there will still be a need, at least temporarily, for support for flash content, Kasm Technologies has developed a work-around for accessing legacy flash technology from a modern browser in a secure and reliable way.

Kasm uses our browser isolation technology to redirect a user’s browsing session to a cloud-hosted disposable web browser…and then displays the browsing session natively in browser via a video feed. Thus, the user is able to interact with the flash enabled website while keeping their native browser isolated from the insecure flash content, accessing only an interactive video stream of the disposable browser.

Kasm Browser Isolation

But don’t take our word for it…try it out for yourself by signing up for a free account. Within our Kasm Disposables Software-as-a-Service offering we have a legacy instance of Google Chrome (v87) with flash supported that will continue to operate into 2021 and beyond.

Kasm Application

Initiate a session with this Kasm Chrome — Flash browser and visit https://helpx.adobe.com/flash-player.html or https://homestarrunner.com to see firsthand that Flash support lives on…and in a secure way.

The flash test page running inside a Kasm Session

A popular flash cartoon homestarrunner.com …running inside a Kasm Session

Serving a custom Flash application with Kasm Server

For those corporations that may still have some Flash applications that will need to be supported while they transition to new web technologies, Kasm Server is able to provide a secure web gateway service to allow them to continue to be used without having an insecure browser on the endpoints. This is accomplished by redirecting whitelisted web browsing sessions destined to the Flash web applications to a headless Kasm Browser that delivers the web interaction through browser isolation.

Kasm has a strong desire for our technology to contribute to the cybersecurity community and be used for good. Thus, our Kasm Server Community Edition provides free browser isolation and VDI capabilities for up to 5 concurrent sessions for home or non-profit users. This can be downloaded directly without any sign-up.

Installing Kasm Server

Kasm server can be installed on several popular installation of Linux. Installation instructions are documented on the Kasm website. Once installed, continue to the next sections.

Kasm Flash Images

One of the powerful components of the Kasm ecosystem is that administrators can create custom Images with the software and configurations of their choice.

The team has published kasmweb/chrome-flash and kasmweb/firefox-flash images on Dockerhub. These images have flash pre-installed and configure for convenience.

While Kasm flash images can be used without modification, these steps will demonstration how to configure flash to auto-run for a particular website without the need to user intervention.

When creating a custom image, we will start from the pre-built kasmweb/chrome-flash:1.8.0 image. The only customization that needs to occur is setting a Chrome policy to autorun the flash plugin, for the desired websites. See Chrome Documentation for more details.

Note: The detailed process for creating general custom application and desktop Images, including a Git repo, can be referenced here.

Creating a custom image

SSH into the Kasm Server.

Create a file named Dockerfile with the following contents:

FROM kasmweb/chrome-flash:1.8.0 USER root

ENV HOME /home/kasm-default-profile

ENV STARTUPDIR /dockerstartup

ENV INST_SCRIPTS $STARTUPDIR/install

WORKDIR $HOME ######### Customize Container Here ########### # Add a chrome policy to autoplay whitelisted sites. RUN echo '{"DefaultPluginsSetting":1, "PluginsAllowedForUrls":["https://helpx.adobe.com", "https://homestarrunner.com"] }' > /etc/opt/chrome/policies/managed/flash.json RUN mkdir -p $HOME/.config/google-chrome/Default/Pepper\ Data/Shockwave\ Flash/System/ # Edit the flash player config (mms.cfg) to whitelist approved sites. Otherwise the plugin will not load RUN echo 'AllowListUrlPattern=https://helpx.adobe.com/' >> $HOME/.config/google-chrome/Default/Pepper\ Data/Shockwave\ Flash/System/mms.cfg RUN echo 'AllowListUrlPattern=https://homestarrunner.com/' >> $HOME/.config/google-chrome/Default/Pepper\ Data/Shockwave\ Flash/System/mms.cfg RUN chown -R 1000:1000 $HOME/.config/google-chrome ######### End Customizations ########### RUN chown 1000:0 $HOME

RUN $STARTUPDIR/set_user_permission.sh $HOME

ENV HOME /home/kasm-user

WORKDIR $HOME

RUN mkdir -p $HOME && chown -R 1000:0 $HOME

USER 1000

Build the image with the following command:

sudo docker build -t my-flash-app:latest -f Dockerfile .

Log into the Kasm Server UI as an administrator.

Select Images , then click Edit (pencil) next to the Kasm Chrome Image.

, then click next to the Image. Update the following settings:

Name: my-flash-app:latest Friendly Name: My Flash App Docker Registry: <empty> Docker Run Config Override: {"environment":{"LAUNCH_URL":"https://helpx.adobe.com/flash-player.html"}}

Update Image

Update Image

Click Submit .

. Select Kasm from the left-hand menu then launch the My Flash App Image.

Create a Kasm Instance

The web application running in Chrome is displayed.

Web Filtering

Kasm includes a Web Filter that can be used to restrict traffic to only the desired site. This is highly recommended when utilizing the image with Flash enabled.

Log into the Kasm Server UI as an administrator.

Select Web Filtering.

Create a new Web Filter Policy with the following settings:

Name: Flash App Policy Deny By Default: Checked Domain Whitelist: helpx.adobe.com

homestarrunner.com

Click Submit.

Select Groups.

Select View (eye) next to the All Users Group.

next to the Group. Select Add Settings.

Add a Group Setting

Select web_filter_policy from the drop down and select Flash App Policy previously created.

Assign the Web Filter Policy

Select Add. The policy is now assigned.

Web Filter Policy Assigned

Select Kasm on the left-hand menu. Click Create n ext the My Flash App Image to create a new session.

on the left-hand menu. Click ext the Image to create a new session. From inside the session attempt to navigate to another website (e.g google.com). The request is denied.