FlashPPT: September 2007

Extract Flash: Conversation with Rhys Jeremiah

Rhys Jeremiah has been working in IT after graduating from Bristol University with a degree in mathematics. He started writing database applications for a large insurance company and quickly moved into web development, the largest site for a major international motor manufacturer. Although now teaching mathematics, he still manages some IT work. He currently lives in Cardiff, Wales with Sarah, his wife, and their children Lloyd and Carys.

Geetesh: Tell us more about your Extract Flash product, and what inspired you to create this.

Rhys: As is often common, the reason for creating the Extract Flash product was to solve a problem that could have easily been avoided. The company I was working for at the time was a major client of a marketing firm here in the UK. Last thing on a Friday afternoon, we were asked to update a flash file on a website and that the replacement file would be winging its way to us via email very soon. None of us in the office were quite prepared for the fact that the file had been placed into a PowerPoint presentation. It seemed that the last thing the marketing company did before the weekend was to send that file as numerous phone calls to get the original file failed. So we had a problem.

I noticed that it was possible to drag and drop the embedded Flash object between Office products and even drop it onto the desktop as a scrap file (http://support.microsoft.com/kb/138275). So I reasoned that the file must contain the Flash file that we were searching for. Hence it was worth digging a bit deeper. On opening the scrap file in a binary editor, I was able to locate the header block of the SWF file and without too much effort it was the possible to pull the binary data out and write it back to disk. The reason I wrote an application to do this is that I enjoy the challenge of trying something new, and also providing a useful tool to the community. In theory the scrap approach would work for any type of embedded object so long as the header block could be read and processed. With a small amount of knowledge it would be possible to change the file to search a binary file for any header block and extract the embedded data. From memory I think that SWF files are held in PowerPoint files without encryption so you don't necessarily need to mess about with the scrap file.

Geetesh: Many people believe that their embedded Flash content in a PowerPoint slide is secure -- so this does prove them wrong. How important is it for them to be aware of this, and would the scrap approach also work with any other embedded content in Microsoft Office documents.

Rhys: From my experience many people think that all embedded files in Office documents are secure. I can't count how many times someone has sent me a Word document containing loads of images. I've never really considered the people actually use this method to protect their files. It's certainly naive to approach security in this fashion. Personally I think that the only way to secure your sensitive data is not to give it away, as soon as you release any information you lose the ability to control the distribution. If you really want to secure your embedded content don't embed it.

Labels: embed, extract, flash, powerpoint