Viral Videos That Really Are Viral

davidwr writes to mention a BBC article looking at booby-trapped Windows codecs. While some codecs required for online videos actually let you watch your content, others are just excuses to infect your system with spyware or adware. As davidwr says: "Now virtual sex can make your computer sick." From the article: "Mr Robinson said many security firms were now logging instances in which spyware and adware firms are turning out software bundles that claim to roll together many popular codecs or just have the one needed to play a particular clip. Some of the codecs do help to play clips, but others are disguised as a variety of nuisance or malicious programs. Some rogue codecs plague users with pop-up adverts, while others invisibly install keyloggers that try to grab confidential data. "

Comments

Firstimus Postimus

[DJCacophony]

This is old news, we already knew that Macs could get GRIDS

Re:Firstimus Postimus

[Anonymous Coward]

"Could" get? I thought it came bundled.

One way to know if code is safe to run

[ajs318]

There is exactly one way to know if a piece of software is safe to run:

READ THE SOURCE CODE.

If they won't let you read the source code, it's because there's something in there they don't want you to see. If they don't want you to see it, that means they're ashamed of it. Avoid it.

Re:One way to know if code is safe to run

[Anonymous Coward]

Not everyone can read source code you elitist asshole. Not to mention, I don't feel like stopping in mid wank to read the source of a codec I need to watch a pr0n clip.

Re:One way to know if code is safe to run

[mrjb]

You don't need to be ashamed of your code not to want other people to read it. It just might be that you don't feel like giving away your life's work. Or that keeping the source closed is the only way not to be sued for patent infringement.

Re:One way to know if code is safe to run

[CastrTroy]

Although that's a little bit extreme, you can't possibly read and understand the source code for every single program you run, it makes a lot of sense. If they are willing to put the source code out there, then they are most likely not going to try and fool you. If they do, then you have the evidence of what they are doing. This is why the first place I go to look for software is Sourceforge. Because everything there is open source, I can be pretty sure that there's no adware, spyware, or other malicious things lurking around. Also, it's the best way to get full featured tools without paying anything. Searching for freeware using google or any other means other than sourceforge/freshmeat, means I have to take a lot of care to figure out what's spyware, and what's not, and which ones will expire in 15 days.

Re:One way to know if code is safe to run

[ajs318]

If you want me to run something on MY computer, I have a RIGHT to see the source code. If you don't want me to know what is in a cake you're baking, there's no way I'm going to let you bake it in MY kitchen.

By the way, evaluating Source Code with which you can show you have no association to determine its suitability for use (or otherwise) is a Service which may be considered to have Value.

Re:One way to know if code is safe to run

[MightyYar]

But do you only eat cake baked in your own kitchen? Would you give up a piece of cake that everyone is raving about because the recipe is a secret? What if the baker had a solid reputation and thousands of satisfied customers?

I'm not sure why someone would have higher standards for what they run on their stupid computer than for what they allow into their body.

Re:One way to know if code is safe to run

[klingens]

Have you ever seen the sourcecode of your BIOS EEPROM?

Re:One way to know if code is safe to run

[Sylvak]

ajs318 probably never ate a Caramilk bar ;)

http://en.wikipedia.org/wiki/Cadbury_Caramilk

Re:One way to know if code is safe to run

[ehrichweiss]

"If you want me to run something on MY computer, I have a RIGHT to see the source code."

First things first, it is usually less of THEM wanting something run on your computer and more likely YOU wanting to run it. If it's freeware that scenario is lots more likely since they don't make money for every installation, etc. so they couldn't care less.

Next, you don't have a "right", you have a desire. If they publish the source code then you have the right to view it, otherwise you're SOL. You're likely not a king or otherwise powerful enough person to get such things done so put your words in some perspective.

Re:One way to know if code is safe to run

[bberens]

You don't even have the RIGHT to a telephone conversation unmonitored by a government agent without a warrant. Start there, and then come back to me with your piddly little 'I want to see source code' complaints. Asking to see the source from a software company is like asking for the recipe for Coke from Coca Cola. One day you'll just have to get over the fact that most companies will not embrace the open source movement. Whining doesn't help.

Re:One way to know if code is safe to run

[Anonymous Coward]

It's exactly this kind of unilateralism that gives OS a bad name.
'I AM CORRECT! YOU ARE WRONG! BOW TO MY MIGHTY RTFM!'

Re:One way to know if code is safe to run

[vertinox]

Not to mention, I don't feel like stopping in mid wank to read the source of a codec I need to watch a pr0n clip.

Why yes! I can see why they modded you informative. Perhaps a bit too informative...

Re:One way to know if code is safe to run

[Anonymous Coward]

I doubt very highly you've read the sourcecode for the firmware in your microwave, car, computer CMOS, game console, or whatever other electronic products you use on a daily basis. I also doubt you've read and completely understood the source code for your OS's kernel, the windowing environment, your e-mail client, or your FREAKIN' WEB BROWSER.

Id10t.

Re:One way to know if code is safe to run

[zacronos]

Not everyone can read source code you elitist asshole.

This is slashdot. The correct term is "insensitive clod".

Re:One way to know if code is safe to run

[k12linux]

I wouldn't eat cake I found sitting out on a park bench either... even if it had a pretty hand-painted sign saying it was safe and the best cake ever made. If, however, I could accurately identify all of the ingredients and confirm it wasn't tainted then I'd probably have a bite.

Re:One way to know if code is safe to run

[GWBasic]

Actually, I'd be weary of jumping to the "because it's open-source, it's malware-free!" conclusion. A couple of years ago I downloaded a bundled installer from doom9.net, a reputable source. It turns out someone had slipped some malware into the installer. (I don't think it's there anymore.) It's really not the source code of the program that will tell you if there's malware; it's the source code of the installer that will tell you if there's malware. For example, the bad guys can make their own installers for of XViD that come chock full of malware.

Re:One way to know if code is safe to run

[MightyYar]

Nope, sorry. It's very good cake, but the recipe is a secret. It comes from a very reputable chef, though, and no one has ever gotten sick. A+ from the board of health.

I'm fairly certain that you've eaten something without first looking at the ingredients.

Re:One way to know if code is safe to run

[drsmithy]

If they won't let you read the source code, it's because there's something in there they don't want you to see. If they don't want you to see it, that means they're ashamed of it. Avoid it.

Your logic is broken.

Re:One way to know if code is safe to run

[Oktober Sunset]

It doesn't matter that most people can't read source code, because we know there are plenty of good nerds out there who lesser nerds like me can rely on to expose this sort of crap.

Re:One way to know if code is safe to run

[k12linux]

In the case of these codecs though there is nothing to give any assurance that they are safe. The reputation of the author is unknown and whether the codec has made anyone sick or not is unknown. No certification body or board has approved or verified them. Based on all that, not knowing exactly what is in them and still using them is just plain dumb.

Re:One way to know if code is safe to run

[MightyYar]

Yes, but I was responding to the guy who claimed that he had a right to examine the code of anything that was installed on his computer. I was trying to point out that he probably had higher standards for what he "feeds" to his computer than what he feeds to himself. They are both IP issues - the cake recipe is a secret, and so is the software code. I DO NOT condone downloading random codecs from the internet, but you are probably okay downloading from Microsoft, Apple, Real, etc.

Re:One way to know if code is safe to run

[ajs318]

If that's the same as a Cadbury's dairy Milk with Caramel, then have I reverse-engineered one just for the h4x0r challenge factor. I think they're most probably made by injection-moulding the hollow "humps" upside-down (chocolate is a thermoplastic, so there's no reason why this process shouldn't work, and the shape of the humps is definitely injection-mouldable); withdrawing the internal part of the mould (the injection holes would be in this retractable "core", so the tell-tale "pip" which characterises injection moulding would be hidden on the inside); filling the humps with caramel; filling the rest of the mould with chocolate to create a base, and finally wrapping the whole thing with pre-printed aluminised polyester film from a roll (the wrappers have visible registration marks, suggesting that they are not being printed after wrapping). I'd also suspect that the production line uses LWIR radiant heating to create precise temperature zones for the moulding processes, because they can do it all without causing the fat and sugar to separate.

Re:One way to know if code is safe to run

[k12linux]

Yes you *probably* are.

I don't agree that he has the right to look at the source code to everything installed on his computer. He does have the right to only install stuff that he can view the source code of but that's just called freedom of choice.

And if you use those codecs with MPlayer on Linux?

[mrjb]

Will your box be at stake then?

serves yah right

[jedimastermopar]

serves yah right for downloading your codecs from limewire just like your porn.

Re:serves yah right

[pegr]

I have to agree. This has been going on for quite some time, at least a couple of years. That's why I simply don't use codecs that come from questionable sources. You wouldn't run just any arbitrary program, would you?

But wait, if there's porn involved... :)

Re:serves yah right

[johnmorganjr]

porn?? yes!! yes!!

Re:serves yah right

[PlasticArmyMan]

The thing is, people do. I've seen on numerous occasions on Limewire and such networks an executable or a zip file for Microsoft Office or Windows XP that is something ridiculously small like 100k. It exists because some twat clicks on it and wonders why a small window opens and then vanishes shortly before their system grinds to a halt...

STDs

[guybert]

Now your computer can get STDs as well!

Re:STDs

[spun]

Now your computer can get STDs as well!

Stupidity Transmitted Diseases?

How is this any different?

[rreyelts]

At first glance I thought the article was talking about security flaws in trusted codecs that allowed malformed content (i.e. videos) to install virii, etc... That's a little scary - much akin to the libjpeg flaw from a year back or so.

However, this article is talking about something much more inane. Why do people expect that codecs downloaded from arbitrary untrusted sources would be any less free of viruses, adware, etc... than any other random executables obtained off the net?

Re:How is this any different?

[DragonWriter]

Why do people expect that codecs downloaded from arbitrary untrusted sources would be any less free of viruses, adware, etc... than any other random executables obtained off the net?

Probably because only a minority of users realize that a "codec" is a kind of "executable" or "program", rather than a some kind of electronic "key" or "description" that enables a media player to decode a particular kind of media file. Its not like the boundaries between safe (or at least, safer) "data" and dangerous "code" are always obvious to non-technical users.

Re:How is this any different?

[99BottlesOfBeerInMyF]

Why do people expect that codecs downloaded from arbitrary untrusted sources would be any less free of viruses, adware, etc... than any other random executables obtained off the net?

The average person assumes data they download will not be able to infect their computer. What kind of an idiot would design a computer such that it lets a random codec someone downloads run as an executable and have access to read their e-mail addresses, capture keystrokes, etc., especially in this day of malware. MS should have fixed this long ago. It looks like Apple has ported MAC from TrustedBSD and will be solving this in OS X 10.5. Maybe t is time you stopped blaming the user for making reasonable assumptions and started looking at just how badly designed most OS's are these days.

Re:How is this any different?

[The Cisco Kid]

s/most OS's/a certain mainstream OS (but very few others)/

Re:How is this any different?

[0racle]

If an application you want to have access to that data can access it, an application running under the same or higher credentials that you don't want to have access to that data can access it. OS X and Linux/UNIX might be a little better designed then Windows, but they do not magically know what should and should not be happening.

Most of virus and spyware infections are the users fault. Computers are meant to do what the user tells them to do, most users tell computers to do stupid things so they do them.

Re:How is this any different?

[rreyelts]

The average person assumes data they download will not be able to infect their computer.

And how did this get modded as insightful? Codecs aren't data, they are programs. What's your first clue? CODEC stands for Compressor/Decompressor (Here's a linky for you). I actually worked on a wavelet codec almost 10 years ago, before anybody had heard about them in relation to JPEG2K.

If you want to argue that operating systems should secure users from malevolent programs that is an entirely different ball of wax. That's a hard problem, and it's what Sun and Microsoft have been trying to solve by creating sandboxes through VMs with the JVM and CLI.

Re:How is this any different?

[99BottlesOfBeerInMyF]

If an application you want to have access to that data can access it, an application running under the same or higher credentials that you don't want to have access to that data can access it. OS X and Linux/UNIX might be a little better designed then Windows, but they do not magically know what should and should not be happening.

Ever run SELinux? It isn't a matter of higher or lower credentials, but of mandatory access control lists that specify exactly what an application/process can access. In this case, a codec should be able to take an input from the player and hand an output to the player and that is it.

Most of virus and spyware infections are the users fault. Computers are meant to do what the user tells them to do, most users tell computers to do stupid things so they do them.

Bullshit. It is not a reasonable assumption for the average person to assume something they download will have complete access to do anything it wants. Ask the average person if double clicking on something called "funny_picture" can and should be able to give someone access to all the e-mail addresses they have stored. The naive assumption that people will only run programs they trust should have died many years ago, when computers became commonplace and so did malware. The only reason Windows has not been fixed to prevent this is because MS has a monopoly and does not have to react to customer demand. The only reason other OS's don't have this, is that they are designed for use in situations where malware is not a problem (OS X, desktop linux distros). Even so, both OS X and the remaining Linux distros at least have these technologies in their roadmaps for the very near future.

People want to run untrusted software. The OS should be providing them with an easy, secure, usable way to do so.

Re:How is this any different?

[Phroggy]

However, this article is talking about something much more inane. Why do people expect that codecs downloaded from arbitrary untrusted sources would be any less free of viruses, adware, etc... than any other random executables obtained off the net?

Because as soon as they do, fresh porn is waiting for them! Or so they've been told.

Re:How is this any different?

[99BottlesOfBeerInMyF]

And how did this get modded as insightful? Codecs aren't data, they are programs.

So? Data is the extreme case, which on Windows is not often differentiated from executables in the UI. To the end user, a codec is simply a decoder ring and there is no reason it should be able to adversely effect the computer.

If you want to argue that operating systems should secure users from malevolent programs that is an entirely different ball of wax. That's a hard problem, and it's what Sun and Microsoft have been trying to solve by creating sandboxes through VMs with the JVM and CLI.

It's a complex problem, but it is one that should be mitigated in every mainstream, desktop OS. In this particular instance, codecs require very, very limited access to the system. Why are codecs not restricted to taking input from the player and handing it back? Why should they have any other permissions? By default they certainly should not. If there is some weird case where they need it, the user should have to explicitly enable that.

Solaris, SELinux, and TrustedBSD all have this functionality, but it is mostly aimed at advanced users and servers. It absolutely needs to be brought to consumer desktops with a good GUI and sensible defaults. Hopefully it will be done properly in OSX 10.5 and MS can copy that.

Re:How is this any different?

[0racle]

Bullshit. It is not a reasonable assumption for the average person to assume something they download will have complete access to do anything it wants. Ask the average person if double clicking on something called "funny_picture" can and should be able to give someone access to all the e-mail addresses they have stored.

Is that so? Ask the average person how a computer works. I doubt you'll get any sort of coherent answer. To the average user, a computer is a magical white box that they don't understand. They will pretty much believe whatever you tell them about computers. Until people learn that computers are not a toy and to use it properly you do have to learn something about it, users are the largest problem.

Ever run SELinux?

Ever seen the average user set up SELinux or any other type of ACL? We're talking about people that don't maintain computers professionally remember. It is more reasonable to expect users to format their system every month or so then it is to have them set up good, or even useful ACL's. These are the types of people that just say 'Yes' to everything. On top of all that ACL's require setting up by someone with a good understanding of what the computer will do, what each application does and exactly what should and should not be allowed. Not only does the average user not fall into that catagory, but most system admins, techs and developers don't either.

Re:How is this any different?

[kabocox]

The average person assumes data they download will not be able to infect their computer. What kind of an idiot would design a computer such that it lets a random codec someone downloads run as an executable and have access to read their e-mail addresses, capture keystrokes, etc., especially in this day of malware. MS should have fixed this long ago. It looks like Apple has ported MAC from TrustedBSD and will be solving this in OS X 10.5. Maybe t is time you stopped blaming the user for making reasonable assumptions and started looking at just how badly designed most OS's are these days.

I agree with you. This is a tech problem rather than a user problem. I remember back in college browsing for porn or warez the only big things to beware of were the porn dailer.exe that wanted your computer to dail out to a 900 number for porn and also the sites that would open 10 windows or the warez sites that made you read the porn site to find their warez site password (that was some times pretty fun.) Now, a day with spy ware, malware, adware and these porn codecs it has just gotten annoying. I downloaded a .avi porn file the other day. I tried to play it. I use either media player or videolan player. Those tso programs should play most of what I download. When an avi that I got off of some random P2P search requires a porn codec to run, I've given up. There is just too much garabe and traps out there. I don't know why I even bother to hunt more porn when I already have GBs of it already.

Re:How is this any different?

[99BottlesOfBeerInMyF]

Until people learn that computers are not a toy and to use it properly you do have to learn something about it, users are the largest problem.

Thank you for that wonderful example of why computer security sucks so badly. If you ignore the human component and write it off as "someday maybe people will learn" you are sure to fail to design a secure system. Ignoring that half of the problem does not fix it. It requires education, but before that it requires a system that can be operated securely without years worth of training in obscure crap that a properly designed system would not require.

It is more reasonable to expect users to format their system every month or so then it is to have them set up good, or even useful ACL's.

User's should very rarely, if ever, have to set up an ACL. Instead ACLs should be set up fro them with good defaults and they might occasionally have to make a change to one. In the example of a codec, why the hell should it not be confined by an ACL to start with as soon as a user drops it in their codecs directory? All the requirements and legitimate interactions are known before the user ever grabs it.

These are the types of people that just say 'Yes' to everything.

No, these are the type of people who click "OK" without thinking because the people who designed the system did not take the human half of the equation into account and instead assumed people were machines. Give a machine a choice over and over and over again and it will operate on the same criteria. Give a user the same button over andover and over again, needlessly making them click the same option to make their computer work and you condition them to click that button.

On top of all that ACL's require setting up by someone with a good understanding of what the computer will do, what each application does and exactly what should and should not be allowed. Not only does the average user not fall into that catagory, but most system admins, techs and developers don't either.

Its not hard at all. Pre-installed apps have ACLs crafted for them. Signed applications are given the ACL they request unless the user specifies otherwise. Unsigned applications are restricted severely by ACLs until the user changes them. When an application wants more access than it has you ask the user, in plain English with a well designed UI. "The program 'MediaCodec17' would like to capture keyboard input from other programs, even when it is not in the foreground (Stop it from capturing input)(Allow it to capture input one time)(Allow it to capture input always)(Advanced Options)." I think the average user can figure that out and if they can't, well with a small amount of education they can.

Your approach of ignoring people as a lost cause is useless defeatism. Fix the OS so that it gives them the option of being secure, then if they still screw everything up you can blame them. You must, however, give them the tools and information they need first.

Re:How is this any different?

[qazwart]

Okay...

I know better than to answer random emails, and download executables off of websites I never heard of. I know that the "free" software that allows me to search the web or shows me the temperature offered by many websites contains all sorts of malware. I know not to "verify" my financial information on the whim of some email saying my PayPal account needs it. I even know that President Mazutu or whoever he is from Nigeria is not wanting to deposit a couple of million dollars into my bank account. I am a very smart Internet user.

However, some website I trust --maybe a blog I read on a regular basis-- has a video of some sort. It's a clip from The Daily Show -- maybe a ten year tribute to Stephen Colbert. I like the Daily Show...

Wait, Windows Media Player can't seem to be able to show it. Hmmm... Oh, the website tells me that it has something to do with an unusual "codec" (Why can't everyone just use MP3)? Anyway, I'm told if I download this codec, Windows Media Player will play this video.

Sounds harmless enough. It's on a website I trust, and it isn't a program of a webpage. Just some file that's needed to play this video. Seems like everyday there's another video format that needs its own codec. Sure enough, download this "codec", and Windows Media Player comes right up and plays this video.

Boy that was funny! I'll send this off to all of my friends. Except for Joe. He's got a Mac and can never play these types of clips because they never make a Codec that works for a Mac. Too bad for him.

Re:How is this any different?

[Anonymous Coward]

I'm not sure where you get this idea. To me, data is something I can view or edit. A program is something that lets me view or edit certain kinds of data. I don't know what it means to view or edit a codec, so it's not data. However, a codec does allow me to view and edit certain kinds of data (audio/video), so a codec is therefore a program.

You do have a good point that it would be nice to prevent a codec from being able to perform arbitrary operations on your computer. The big question is who gets to decide what operations are allowed? It sounds like you think a codec should just read in a buffer, perform some math on it, and write out a new buffer. Perhaps you don't think the codec should be able to access hardware, create processes, talk over the network, or write to the hard drive. Of course codecs are usually dynamically loaded libraries, meaning they can do anything their host program (web browser/media player) can. To properly restrict a codec, it must be run as a separate process with all the communication overhead that entails.

What if my codec needs to talk to MPEG decoding hardware? What if my codec needs to use the GPU on my graphics card to perform some of its functions? What if my graphics card doesn't have a GPU so the codec needs to talk over the network to my GPU server? What if I want to call out to an ImageMagick process to do some image processing? What if my codec needs to read or write some configuration data? How about if I want it to cache some data to the hard drive?

You need to either unnecessarily restrict what a codec can do, or create some kind of crazy security framework to specify exactly what resources it is allowed to use. That seems like a whole lot of work just to mitigate one limited form of attack!

dom

Re:How is this any different?

[99BottlesOfBeerInMyF]

The big question is who gets to decide what operations are allowed?

That's easy. Ultimately it is up to the user, but pre-installed software can have an ACL based upon what it is likely to need. Signed software can default to an ACL included with that software. Unsigned software is heavily restricted by default, depending upon the code type/location. For example, code in your codecs directory and unsigned can only take data from the host program and return it to the host program. The user can open it up more if necessary. Programs in the user's directory can create files in the user space, but not read or overwrite any files they did not create.

Perhaps you don't think the codec should be able to access hardware, create processes, talk over the network, or write to the hard drive.

I'd say all of those functions (excepting perhaps writing a given scratch file) would be unusual for a codec that did not ship with your machine and which is unsigned. So yes, I think those actions should be restricted by default.

What if my codec needs to talk to MPEG decoding hardware?

Then get it signed to demonstrate it is not malware. The same goes for any software that wants unusual access.

What if my codec needs to use the GPU on my graphics card to perform some of its functions?

So, call it through OpenGL and it will have the same access as anything else, that is why the API exists.

You need to either unnecessarily restrict what a codec can do, or create some kind of crazy security framework to specify exactly what resources it is allowed to use.

That "crazy framework" already exists in all of the more security minded OS's and it is making its way into desktop OS's now (except Windows of course).

That seems like a whole lot of work just to mitigate one limited form of attack!

Mandatory Access Control coupled with application signing mitigates buffer overflows, trojan, worms, spyware, and pretty much every major security hole normal desktop users deal with today. It would basically make all but a handful of current generation malware obsolete and make future malware a lot harder to write. The hard part remaining is to make it user friendly, accessible, and to create sensible defaults.

Re:How is this any different?

[Anonymous Coward]

I'm afraid you are a bit naive. Signing an application doesn't in any way demonstrate that it is not malware! All it does is tell you where the app came from. You can then make an informed decision as to how much to trust the app. Unfortunately, people are willing to trust those that they should not be trusting. If I want to make some malware, all I have to do is sign it as TrustworthyPr0n.com and people will trust it because they want their pr0n.

Regardless, let's say that you do have a "code signing with ACL" type of thing Microsoft created for .NET, and you are going to write an ACL for your codec. How do you write an ACL lets it run ImageMagick, write files to local hard drives, and access the MPEG hardware? Can you do it so that it works on a machine where you don't already know where IM is installed, where local HDs are mounted, and what the device name of the MPEG hardware is?

BTW, Vista implements the Biba model of Mandatory Access Control. That's how the low-rights version of IE is prevented doing bad things to your computer.

dom

Re:How is this any different?

[Anonymous Coward]

"What kind of an idiot would design a computer such that it lets a random codec someone downloads run as an executable and have access to read their e-mail addresses, capture keystrokes, etc., especially in this day of malware."

WTF? Even assuming you could design a codec that didn't run as an executable, this wouldn't help against this kind of social engineering. The malware author could just create a setup.exe that claims to install a codec and J. Random Newbie would run it and still get owned.

Re:How is this any different?

[99BottlesOfBeerInMyF]

Signing an application doesn't in any way demonstrate that it is not malware!

That depends upon the service. Many simply verify that a certain binary or whatever is from a certain domain, but others verify that the domain is owned by the company who has the associated trademarks or who is doing legitimate business. There is a lot of room for levels of trust here to correspond to levels of ACL restriction. Better yet, power users will be able to customize this to their own level of paranoia.

How do you write an ACL lets it run ImageMagick, write files to local hard drives, and access the MPEG hardware? Can you do it so that it works on a machine where you don't already know where IM is installed, where local HDs are mounted, and what the device name of the MPEG hardware is?

Yes to all of the above. It is certainly not an unsolvable, or even difficult problem. As I mentioned about the hard drive thing earlier, most programs will need to write to the hard drive. Restricting that as a chunk is nowhere near granular enough and current systems provide much more flexibility. Programs would be restricted from writing more than a given amount of drive space and can only write it in their own application folder by default.

BTW, Vista implements the Biba model of Mandatory Access Control.

Even XP has most of the necessary plumbing. The problem is MS does not bring this functionality to users in a useful way.

Re:How is this any different?

[99BottlesOfBeerInMyF]

WTF? Even assuming you could design a codec that didn't run as an executable, this wouldn't help against this kind of social engineering.

The point is not to make non executable codecs, but to restrict executables in general. I think you are failing to understand what Mandatory Access Controls are.

The malware author could just create a setup.exe that claims to install a codec and J. Random Newbie would run it and still get owned.

No, because different programs are trusted different amounts. An installer that is not signed/verified by a trusted certification will be unable to do anything but place a folder or application package in that user's programs directory. People will run software they don't trust. The point is to make that behavior relatively safe by default.

Question

[jackharrer]

Let me guess - only one very popular operating system affected?

Re:Question

[MightyYar]

Probably, but this technique would work on Mac or Linux, too. Actually, the Linux crowd might be a little skeptical of an "installer"... what the hell is that??? You mean make install?

Re:Question

[nacturation]

Probably, but this technique would work on Mac or Linux, too. Actually, the Linux crowd might be a little skeptical of an "installer"... what the hell is that??? You mean make install?

Good point. And how many Linux users download some source code and run sudo make install without any code review first?

Re:Question

[Grishnakh]

I get all my codecs in a single .RPM file from the official MPlayer website at mplayer.hu. Not downloading singular codecs from weird websites seems like a good idea.

Moo

[Chacham]

Videos infected with viruses, video at 11.

Re:Moo

[CagedBear]

Breaking news: 11 o'clock news video about viruses infected with virus. Video at 12.

Re:Moo

[Chacham]

Breaking news: The guy who shot the guy who shot the guy who shot the guy who shot the guy who shot the guy who shot the guy who shot the guy who shot the guy who shot Alfalfa was caught.

Reporter: Why did he do it doc?
Doc: Probably for fame. He didn't know how to write a good virus.

Few examples or details

[Anonymous Coward]

The article doesn't say much or give any details you can work with. I suspect codecs themselves are immune as infection vectors as they are not executables. WMP files can cause a redirect to a web site and have licensing which cause me no stay away from them.

As far as codecs, I stick with the K-lite codec pack or K-lite mega codec pack (which features quicktime and real without all the startup crap). Don't download video that is packed in an executable, and if it doesn't play with the k-lite codecs, you don't need to watch it.

Re:Few examples or details

[dunkers]

Codecs are executables - they're basically DLL's with specific calls exported to suit the multimedia subsystem. Windows Media Player also downloads codecs automatically if you let it, so all the bad guys need to do is make sure Windows knows where their codec is located then give you a video that will require it. Windows will then toddle off and run the malware completely automatically.

Re:Few examples or details

[grondu]

Here you go:

http://sunbeltblog.blogspot.com/2005/12/beware-vco dec.html
http://sunbeltblog.blogspot.com/2006/09/another-fa ke-codec-site_20.html
http://sunbeltblog.blogspot.com/2006/09/seen-in-wi ld-another-fake-codec.html
http://sunbeltblog.blogspot.com/2006/09/another-fa ke-codec-site.html
http://sunbeltblog.blogspot.com/2006/10/some-more- fake-codec-sites-for-ya.html

I suspect codecs themselves are immune as infection vectors as they are not executables.
And what do you think does the coding and decoding?

Re:Few examples or details

[antdude]

FYI, Mega pack doesn't gets frequent updates for RealAlternative and QuickTimeAlternative. So, I just use the full pack (with its MPC) and then install RA and QTA separately (without their MPC).

Re:Few examples or details

[HermMunster]

And it is automatic download by default. Check a new install.

For those out there with their apish gruntary about who knows what: well, the average person doesn't know what a codec is and has absolutely no clue about how their computer works. Most don't know how to use most of the software on their computer and have problems understanding directories vs. partitions.

So, come down to reality here and realize that it is MS's issue and it needs to be addressed. Listen, it's a computer. What computers do are repetitive tasks. That's what sandboxing does. It is taking the repetitive function of having to constantly check whether this or that program is good or bad. Sandboxing eliminates that--because the computer is A COMPUTER. The human is prone to errors and misinterpretation which is why half the computers get infected.

Suspicious...

[Anonymous Coward]

Just as people are taking to qt and real alternative this news comes out.

WARNING: Unofficial kool-aid is bad for you!

Media codecs suck. I encode theora, are people going to stop installing that in favor of official DRM malware because of this? How very...

Install FFDShow

[N8F8]

Install FFDShow, Flash and Quicktime. If it don't play then it ain't woth playing.

Re:Install FFDShow

[Salsaman]

What about ogg theora and x264 ? Without those, you are missing a) the most popular Free codec, and b) probably the best "Free" codec available today.

Re:Install FFDShow

[Anonymous Coward]

The best package I've seen to date is the K-Lite Mega CodeC Pack. If you can't view a particular video with that package, get a mac! ;-)

Re:Install FFDShow

[N8F8]

I believe both are currently supported.

Re:Install FFDShow

[just_another_sean]

Not sure about x264 but I'm pretty sure that ffdshow does support theora with their latest release.

Related links:
Wikipedia
afterdawn.com

Re:Install FFDShow

[CastrTroy]

Well, if you want to play x264, you can just use quicktime, which is one of the things your parent mentioned. If you want to play Ogg Theora, then you can install that, although I don't think it's really that popular. I can count on one hand the number of videos i've downloaded that were encoded using Ogg Theora. And they weren't anything that was really worth seeing.

Re:Install FFDShow

[Snover]

The latest version of ffdshow supports both Theora and X.264 (AVC1). X.264 needs to be manually enabled, but it is there, and it works great.

Re:Install FFDShow

[Antiocheian]

Yes, FFDshow and codec packs are nice, but the reliance on DirectShow is still disturbing.

The best solution is to avoid DirectShow and Media Player (or Windows Media) completely.

You can use the VideoLan client. It is faster than DirectShow and does not rely on codecs. And it will never download executable code.

Re:Install FFDShow

[Anonymous Coward]

Yes it does support both, and a very current beta on http://x264.nl/ touts that it has improved speed "13-10-06: ffdshow tryout revision 382 (clsid) added, faster H.264 decoding." You can also get a very nice H.264 opensource codec and an encoding GUI there, very high quailty stuff. The Encoding GUI: http://mewiki.project357.com/wiki/Main_Page/

Re:And if you use those codecs with MPlayer on Lin

[$RANDOMLUSER]

Running Linux does not make you invincable. It would be an easy thing to include some "if (OS == LINUX)" code. A captive Linux box is a worthier target than an XP box, and there are no "automatic" tools to sweep it clean. Many Linux users don't know all the things running on their box, nor pay much attention to it. Do YOU know what all the processes from "ps -ef" do? Are you sure that the process named is really that process?

hmmm...

[testednegative]

that takes STD's to a whole different level. lets get the ball rolling.
Spyware Through Download

Some of us have a life

[everphilski]

Some of us have a wife and kids, a full time job, working on a masters/Ph. D, other commitments outside the daily grind. We don't have time to sit down and scrutinize every bit that enters our computers (I could - I'm a compotent programmer. That's not the point.). If I choose to download something I trust the developer. I have a level enough head on my shoulder to figure out what looks fishy and what doesn't. And if, for some reason, something bad does happen? Takes but 10 minutes to reimage a drive. Big deal.

That being said the primary machine at home for gaming/surfing is a windows box. Between me, my wife and my kids I don't think I've had to reformat it since it was built.

Re:Some of us have a life

[Anonymous Coward]

I'm a compotent programmer

Too bad you're not a competent speller.

Re:Some of us have a life

[lerxstz]

Compotent programmer; "Competent omnipotent important component coder"?? :-)

Re:Some of us have a life

[everphilski]

Too bad you're not a competent speller.

Too much work to do to give a damn about spelling, did you read my post? :)

Re:Some of us have a life

[Potatomasher]

This is the reason why efforts such as TrustedBSD and the upcoming features of OSX 10.5 have to be encouraged. Users should have a way of running applications in sandboxes... In theory, a video codec should have no business registering keystrokes, and communicating over the network (aside from licensing, drm stuff which is not technically codec work), so why don't today's OS allow us to specify that ?! A simple right-click (apple-left-click), properties - Disable network use, Allow hard drive access to media folder, etc....

Combined Community Codec Pack

[TheSHAD0W]

I'm going to personally recommend a codec pack called CCCP, or the Combined Community Codec Pack. It's primarily meant for viewing anime, but I've never come across any video it couldn't play (aside from MOV and RM). It claims to be free of any sort of malware, and there are a lot of good people vouching for it.

If anyone has any information about malware being present in this codec pack, please respond to this post; since I have this installed on my system I'd be very interested in hearing it. :-)

Re:Combined Community Codec Pack

[Nanoda]

Don't have mod points, so I'll just second your post. CCCP is actually a bunch of separate packages, including ffdshow and others. Lots of work goes in to making sure all the codecs work together, and that it's installable / uninstallable / upgradeable with minimum hassle.
I haven't seen a file yet they won't work on, and they're efficient enough to allow my underpowered laptop to have full-screen video.

Re:Combined Community Codec Pack

[thelost]

I will second that recommendation and state that in my personal experience there has never been any spyware or viri in CCCP.

The obvious alternative is of course VLC - however a lot of people will be turned off by VLCs apparent lack of spit and polish compared to other video players for windows, mainly because it is not always simple to use & it's seek bar sucks ass; devs flatly refuse to do anything about that (although it's my understanding that the way it's currently written it is actually impossible to fix the seekbar).

Re:Combined Community Codec Pack

[bmajik]

The CCCP is a great project, and i've dropped into their IRC channel before with bug reports / problems / questions. CCCP works on Vista and lets you get softsubs, mkv support, etc under Media Center on both XP and Vista.

I've only found a small sampling of content that doesn't "just work" with CCCP, in which case, VLC usually suffices. To be fair, to get CCCP playing how i want in MCE i usally set Haali to always load VSFilter, and i set ffdaudio to SPDIF passthrough for ac3/dts, which means i can only mute/unmute those audio streams with the MCE remote. Also, I configure the Haali splitter for my language preferences so that i don't have to try and get WMP/MCE to talk to the stream switchers in those formats (it doesn't).

Re:Combined Community Codec Pack

[Anonymous Coward]

Que?

Re:Combined Community Codec Pack

[bmajik]

No Comprendo.
Verzeihung. Viederholst, bitte.
sumimasen, wakarimasen.

all i can figure is that you are making some pun/joke about setting language preferences, in which case, i'll elaborte.

Haali Media Splitter lets you set audio/subtitle language sets in a prioritized list, so soft subbed content in MKV or OGM containers can display the right streams according to your preferences.

If i can get it, i like japanese audio with english subtitles, but if i cant, i like english audio with no subtitles. Haali contains all of the stream mathcing/selection logic to encode my preferences so that i dont need to hit any buttons to get the right language/subtitle tracks, assuming the MKV is authored with language tags on the streams. If not, MKVToolnix can add the tags and re-encode the media (without actually doing a decode/re-encode of any streams... it just updates stream metadata)

Re:Combined Community Codec Pack

[Chris Brewer]

At least link to the project page....

Re:Combined Community Codec Pack

[Anonymous Coward]

While I'm not aware of any spyware in CCCP, I'm still going to buck the trend and advise against installing it. Bear in mind this is based on my experience of it over a year ago, it might have changed since.

If you have a problem, there is no way to easily undo what it has done to your computer. It broke the audio codecs on my computer, so that anything that used the WMP codecs was unable to play mp3s, or mp3 data as the audio track to a video. I spent hours ripping out everything that CCCP had installed (after attempting to reinstall/install over the top) and eventually got it working again. But I won't trust it again.

Re:Combined Community Codec Pack

[l0cust]

Thanks for the info. Will give CCCP a shot. On my windows system, I have always used k-lite and no problem so far. I would like to know if there is anything 'wrong' with k-lite because I have been using it for long and recommend it to any poor soul who may want to get the videos working on his system.

Codec packs are for morons

[dark_requiem]

Codec packs are for suckers, I think most people should know that by now. Even when everything in them is legit, you end up with a dozen codecs for a given format, which you don't need, and are bound to create problems. Besides which, you want to be sure you're using the best codecs for a given format, which is harder when you have a dozen to chose from. You should always install individual codecs for a specific format. Go to this page for a list of all common formats and specific codecs to use for each of them (they also make a bitchin' media player, and, no, I do not work for them). I followed this guide to install codecs on my system, and I have yet to run into a video format I can't play.

Actually, I have run into one "format" I can't play, and that's Vodei. Another problem with codecs is jerks like this. The video and audio are already encoded, but they add an additional useless layer so you have to buy the vodei "codec" to play a movie, even though you may already have the proper codecs to actually decode the video data. So just a brief PSA, don't buy vodei or download movies that use it, it's a scam

In short, do it yourself and you'll do it correctly, stay away from codec packs.

Re:Codec packs are for morons

[Anonymous Coward]

These Windows codec packs work great with mplayer in Linux.

Re:Codec packs are for morons

[Anonymous Coward]

I use Zoom Player primarily, as well as VLC and Media Player Classic. What bugs the shit out of me is that I really need all 3. And all 3 crash spectacularly on various media, many times rendering my system unusable for minutes at a time. They all have problems skipping forward on some media.

In Zoom Player, GraphEdt.exe crashes all the time, particularly on low grade webcam type videos. When it does crash, it can hose my system for several minutes if not permanently, making the windows UI so unresponsive it takes minutes to open Task Manager and kill it. It also seems to like to play subtitles by default, especially if they are in a mkv container. I like Zoom Player's customizability the best tho. I just replaced my 2 Via Epia media systems with Pentium M 770 on the Aopen i915GMm-HFS mobo (with bultin DVI/Component 1080p video out). But before that I had to use a specific version of PowerDVD's MPEG2 codec for Hardware accleration to work on the Via systems, which only Zoom Player supported well.

I use an IR keyboard, along with an IR remote that has learned the keyboards cursor keys, space bar etc so I can use a remote or the keyboard to navigate in the apps. It's annoying that I need all three players because I have to go and set up the keybinds in each.

Media Player classic doesn't cut it because it's UI is so bad. It also has crashing issues on various videos, or hangs on media occasionally.
VLC is okay, but it has crashing issues too. It's UI is a little better, with at least some on screen display stuff, but pause is 'squishy' (it's not immediate). And why does the slider have to jump in increments when I click it? Why can't it just jump right where I clicked? I guarantee, that almost no one, when they click just to the right of the slider, expects the slider to jump PAST where they clicked.

Fast Forward and Skip ahead in these apps is atrocious as well. I know that at a certain point it is the media itself, and jumping into a bunch of P frameslooks like garbage until you get another I frame. But Zoom Player and MPC just HANG. Or take 30-60s to I guess process every frame to get there, sometimes more. VLC handles this the best, but I am usually only using it after one or the other has already crashed on the media...

The one feature I miss in all of these players is Xine's 10% increments on the number keys. I had it set up so 1-0 did 10%/20%...100% on the keyboard. So much easier than skipping ahead Xseconds 20 times. I had a MythTv setup a couple of years ago with all the players, but it just took so much effort to get going on the Via systems at that point. I would consider going back, on my new systems, but again with the i915 having hardware support for mpeg2, I can only imagine the custom driver/kernel/xine-mplayer rebuilding nightmares from my past.

And don't get me get me started on the various encoders, like MeGUI, etc. You need as PhD in signal processing to figure these things out. And the only way to get there is by reading hundreds of contradictory posts in the forums.

OH, and while I'm at it... the forum software used on most sites and doom9? When I do a search for something, I don't want to be taken to an index that says 'Somewhere in the next 213 pages of posts in this thread, your search phrase was used'. Seriously.

Re:And if you use those codecs with MPlayer on Lin

[Anonymous Coward]

dumbest post ever

VODEI

[LCookie]

Can anybody say Vodei??
This is not even a Codec, it's a wrapper. Vodei infected AVI files require you to download
their "codec" from http://www.vodei.com/. Funny thing is Vodei infected AVI's
actually become BIGGER and it's a real pain in the ass to convert them back to regular AVI.

Actually it's a good plot since the same guy who owns Vodei also owns moviesempire.com.

1) Illegaly distribute crippled pr0n movies.
2) Make ppl download the spyware/malware ridden "codec"
3) Profit!

Now?

[Anonymous Coward]

As davidwr says: "Now virtual sex can make your computer sick."

From the living-under-a-rock department?

Re:Now?

[britneys 9th husband]

No problem, just practice safe virtual sex

99% hosted on Esthost /Atriva

[Anonymous Coward]

http://www.esthost.com/

based in ...USA !
yet nobody Police, FBI, SEC or even who they peer with will shut them down, money talks in USA i guess
land of the Outlaws

This is 2006 - get with the times

[Anonymous Coward]

With translucent windows, you can write or audit source code while jacking off to hentai.

And no, it's not a productivity boost. This is actually one of the reasons Vista took so long, tho it can be a source of inspiration. Obviously Vista's protected mode was inspired by a posh wank.

oy, that was obvious (and painful to read)

[Red Flayer]

Some of the codecs do help to play clips, but others are disguised as a variety of nuisance or malicious programs.

I know when I want people to use my codec, I disguise it as malware.

The upcoming Halloween holiday is already being exploited by malicious hackers who are baiting websites with viruses and trojans.

Who would bait their website with viruses? I mean really, is someone going to click on a link that says "Get your viruses here!" The video content is the bait, the malware is the payload.

Re:And if you use those codecs with MPlayer on Lin

[zbyte64]

Simply put, not likely

1) The installer for these "codecs" is probably what installs the spyware, not the codec itself. So unless you ran the installer on wine I don't really see how you could install the codecs. And if you did install it on wine, there's no gaurantee the spyware would be able to run on wine and it would be rather strange to see an instance of wine running even after the installer is finished.

2) If the codecs are simply in a zip file and the spyware is embedded in the DLL then the spyware part of the codec will make calls that mplayer's environment will not likely provide it.

A person below your post said that this was the dumbest post ever, sadly he was modded down, but then again, he didn't explain why.

Read the Source code? Are you serious?

[runlevel 5]

Outside of the scope of this article, there are dozens of reasons not to relase your sourcecode, among the most common being the proffit motive. A A lot people look at OSS with are "why by the cow when you get the milk for free" attitude. What about companies that haven't yet copyrighted or patented the algorithims in their software before they go to market? And do you really think companies like Adobe and Autodesk are ashamed of their award winning flagship software packages? Quite honestly, your last argument is utterly rediculous. To bring things a bit closer to home, it's often way simpler, smarter, and faster to distribute codecs in binary form. People just want them to work right away without firing up the windows equivalent of "./configure --with-notrojans". If they have trade-secret compression algorithims, then your company may not want to give them to your competitors. Finally, even if the source code were made public, users have to read thousands of lines of code before knowing if it was "safe" or not. I seriously doubt you'd find any comments that say ""// Computer-destroying virus begins here". And safe is a relative term, because for some machines a segfault is just as bad as a trojan horse.

Re:Read the Source code? Are you serious?

[ratboy666]

Trade Secret -- sure, that's a reason.

But, I still prefer "open source". Profit is not the issue. If someone I trust has a look, its good enough. And I don't trust most vendors.

I personally don't read all the code; not enough time, but I do prefer if it is possible, and if I can get a proxy to do it. I don't run "binary only" software, unless it is in a sandbox (and not directly connected to the internet or internal network).

FYI: Anything published is pretty much under copyright.

Sure, distribute the codecs (or whatever) in binary form -- but I assert it is negligent to run a binary only program, unless you trust the vendor/supplier (if you are connected via high-speed link to the internet).

I don't care if is a codec, or a major application. Its just wrong.

Again, FYI: As long as this is the custom, you will see malware of various sorts.

Raboy

Re:Read the Source code? Are you serious?

[drsmithy]

I personally don't read all the code; not enough time, but I do prefer if it is possible, and if I can get a proxy to do it. I don't run "binary only" software, unless it is in a sandbox (and not directly connected to the internet or internal network).

What hardware devices are you using which all have open source firmware ?

Again, FYI: As long as this is the custom, you will see malware of various sorts.

You will see malware so long as ignorant people can run arbitrary code on their machines.

Re:Read the Source code? Are you serious?

[ratboy666]

"Open firmware" - if its available. If not, I need to have the interfaces suitably 'vetted.

Examples: x86 instruction set. Interfaces to BIOS, monitor, network switch. Interface to keyboard.

As long as I am reasonably happy that the possibility of malware vector is low, I'll use it.

YMMV
Ratboy

Fox and ABC episode viewers

[meburke]

Yup, the article is right on. ABC won't run unless adblocker is off, Fox's episode viewers not only won't run unless adblocker is off, but installs popup ads.

Welcome to 15 years ago.

[Purity Of Essence]

This is news? This matters? Nerds know better.

this is the best I've found..

[mottie]

The DefilerPak is a minimalist collection of video and audio codecs designed to keep you up to date with the latest developments. http://hellninjacommando.com/defilerpak/ What's included? ffdshow: Rapidly making codec packs obsolete. Plays almost everything. Haali Media filter: Supports the Matroska, MP4, and OGM A/V container formats. VSFilter: Supports a wide variety of subtitle formats. DivX ;-) Audio: Just in case. AC3 XForm filter: Makes life a little easier for folks with external Dolby Digital decoders. HDTVPump: Support for HD/ATSC transport streams.

Booby-trapped sex-video codecs

[ettlz]

Boobs... uh-huh-uhh-huh-uhh...

Um... sorry, just had a bit of Beavis and Butthead moment there.

Source code is NOT enough

[davidwr]

A paper from the '70s said it best: Trust has to start somewhere, and nothing is trustworthy.

You can't trust your application source code unless you trust your build and execution environments. This means trusting everything from the chip and motherboard to the firmware to the boot loader to the OS to the compilation environment to the run-time environment. We are already seeing trust issues with virtual machines eating colorful pills when the underlying real machine is compromised.

If there's a trustworthy place to get a PC, OS, build-environment, and run-time libraries, there's probably a trustworthy place to get codecs and other application binaries too.

If you are really paranoid, get a trusted PC with a OS and build- and run-time environments even if it's not one to your liking, then build your own environment, create an install image, install it, then build your codec from source. Very few of us have the time to be that paranoid.

Re:Source code is NOT enough

[lisaparratt]

Far out reading disc E:

(T)urn on, T(u)ne in, (D)rop out?

Re:Source code is NOT enough

[ajs318]

No, source code alone is not enough; but it's a bloody good start all the same. Even if you don't understand it yourself, you can always show it to someone who does.

The reason source code is not a sufficient condition for security is that the compiler (which you have to run as a binary) may produce binaries that do something other than the source code fed into it would suggest. If you use it to compile the source code for a compiler, it might produce a "dirty" compiler which similarly mungs any source code fed to it. You can get around that by writing a simple C interpreter in assembler, just able to run the C compiler interpretatively as it compiles itself. Even then, you can't be sure that, say, a MOV instruction will just move a value from one register to another. Beyond that, you really need to build your own processor from discrete components.

I've got nothing against Russia...

[benhocking]

But naming a codec after the former Soviet Union does not exactly inspire confidence.

Re:I've got nothing against Russia...

[Anonymous Coward]

They say that true irony requires two audiences: those that "get it", and those that don't.

Re:I've got nothing against Russia...

[Anonymous Coward]

Isn't that supposed to be 10 audiences?

Re:I've got nothing against Russia...

[Anonymous Coward]

In Soviet Russia codecs hack you?

Re:And if you use those codecs with MPlayer on Lin

[The Cisco Kid]

Yeah an "if (OS = LINUX)" in a .EXE file would be so dangerous to a linux box, riiiiight.

How about this - video sites stop trying to serve codecs and special players, they just serve the video DATA, and let the user decide what software to use to play them.

If you see 'click here for the video' and its 'http:// [..] / [..] .EXE' - heres a hint - its not a video, its malware.

I Blame Apple and MS

[Anonymous Coward]

You need Quicktime to play stuff, and you have to download it from Apple. That s*** isn't included in Windows. Worse yet, it tries to push iTunes and other crap you don't want. So. Apple sets the standard pretty low for 3rd party codecs that need to be installed. Then, MS for whatever reason can't bundle DivX.

Apple either won't or can't play nice with MPlayer. MPlayer's update mechanism is insufficient.

Together, they create a climate in which it's believable that you need to download and install a 3rd party codec yourself, and that's where the fun begins.

Baghdad Bob Has a New Job!

[adavies42]

Baghdad Bob is alive and well and living in China!

Re:Baghdad Bob Has a New Job!

[Dr. Eggman]

uhh... I think you ment to post that here.

Really?

[Anonymous Coward]

I thought my PC was lying when it told me that it burned while defragging...

Where has the beeb been for the last 20 years?

[Cid Highwind]

"Now virtual sex can make your computer sick."

Is the situation now really that different from when people propagated computer viruses by trading infected Apple ][ floppies? Anyone who ever tried to download Leisure Suit Larry from a pirate BBS can tell you "virtual sex" has always carried a risk.

Re:And if you use those codecs with MPlayer on Lin

[morgan_greywolf]

Yeah an "if (OS = LINUX)" in a .EXE file would be so dangerous to a linux box, riiiiight.

It depends on whether or not Wine is on the box. On an Ubuntu or Debian box, for instance, .exe files are, by default, associated with wine in the GNOME mimetypes. Before you say "Yeah, but anyone bright enough to be running Wine isn't gonna just automatically click on an .EXE", realize that installing and configuring Wine is very easy these days with programs like winetools.

If Wine is on the box, all bets are off. The .EXE could easily embed a Linux binary payload and even execute it (or at least cause it to be executed).

Of course, if you don't run wine apps as root and you have taken reasonable security precautions, the damage that can be done is limited.

Re:And if you use those codecs with MPlayer on Lin

[element-o.p.]

and there are no "automatic" tools to sweep it clean

meh...not sure I entirely agree with you here, although I will concede that many Linux users don't know what tools are available and even less use those that are available on a regular basis.

Tools that I use regularly to keep tabs on my boxen:
1) http://www.chkrootkit.org/chkrootkit: can be run from cron to look for suspicious files and rootkit signatures;
2) netstat -ep: to show what processes are using network connections;
3) lsof: to show what files on your system are open, who opened them and with what process they were opened;
4) http://www.tripwire.com/Tripwire or http://www.gecko-ak.org/Sentinel/my own, open-source, much less functional, still really in development Tripwire-like file system auditor: to check for changes in binaries, config files or anything else on your file system that you would like to keep tabs on;
5) http://www.insecure.org/nmap: to remotely scan computers on your network for open ports, and to audit the services using these open ports;
6) http://www.nessus.org/nessus: like nmap, only different;
7) tcpdump/ethereal/wireshark: to monitor packets in or out of your computer;
8) http://www.snort.org/snort: okay, I haven't (yet) used this one, but it's the open-source standard for IDS;
9) http://www.bitdefender.com/bit defender: anti-virus for Linux--we had to use this once at work to remove a Windows virus that had infected our Samba shares (note: the Samba server wasn't infected, but the Windows machines that were mounting shares from the Samba server were--and they kept rewriting infected Windows executables to the server).

So, no most of these aren't automatic, and most of these won't clean your Linux PC's, but there are a host of tools that you can use to detect problems on your Linux computers. And, if you're really paranoid, there are several vendors that provide anti-virus software, just like what you find on your Windows machines.

BBC: Welcome to the internet, circa late 90s

[Ayanami Rei]

I remember seeing this stuff even as far back as '98 when I first starting using high speed internet through school. USENET and the early file trading networks for chock full of propietary encoded formats that would install 1-900 number dialing VFW filters if you tried to get them to work.

Ok, So What Are the 'Safe' Codec Packs?

[ubuwalker31]

What are the safe, 'all in one' codec packs for windows? Links please! Also, the article doesn't mention the unsafe packages...are there any notorious ones?

Re:And if you use those codecs with MPlayer on Lin

[MbM]

I think you missed the point of the article. You attempt to play a file in your favorite media player and the following message pops up:

"Could not find codec for proprietary-spyware-codec; would you like to install the spyware from the website?"

(Obviously not worded so blatently)

Re:And if you use those codecs with MPlayer on Lin

[jandrese]

To be honest, I'm not that worried about the Wine infection vector. It's my experiance that even well behaved programs are a crapshoot in Wine, trying to get something underhanded working in Wine would be a nightmare, especially with all of the different versions out there.

Re:And if you use those codecs with MPlayer on Lin

[ehrichweiss]

Are you that obtuse that you can't read between the lines OR notice what the real issue is here?

The "if(OS=LINUX)" doesn't have to come in a ***Windows*** exe, or did you not think about that? And most of the malware like this doesn't portray itself as an .exe but can be a dll or otherwise AND on video sites like TFA is talking about, you go to download the video and are unable to view it and then they suggest you use their codec, not once will you see "http://blah.com/blah/blah.exe" since most is done with ActiveX or the like. The weak link here isn't the computer or operating system. PEBCAM.

Naaah...

[Svartalf]

In the case of the computer, it's PTD's...Pr0n Transmitted Diseases...

I saw this happen ages ago

[Anonymous Coward]

This is old news; I ran across a video clip about 3 years ago that got WMPlayer to download one of these "codecs" for me. It actually did make the video play, but also dropped a trojan.

Of course, it wasn't a very good attempt, since it was easy to notice / get rid of before the first reboot, but I remember a lot of people complaining about it at the time...

Do you have ANY idea how this works?

[DeadCatX2]

What kind of an idiot would design a computer such that it lets a random codec someone downloads run as an executable and have access to read their e-mail addresses, capture keystrokes, etc., especially in this day of malware.

Are you for real?

Have you ever heard of a buffer overflow? That's pure data - hex bytes, etc. A buffer gets properly crafted with malicious data that can point the Program Counter of the microprocessor into data memory, which is entirely possible with these Von-Neumann architectures that we use. And where does the PC end up pointing? To some machine-code, which does something like launch a shell.

So, because John Von Neumann designed a memory architecture that allows data to be executed as code, do you think he's an idiot too?

And even forgetting for a moment that data will always represent a possible attack vector (unless we change the way RET works, or we switch to Harvard architectures), a codec is essentially a program that uses instructions to operate upon data, changing it from one format to another. The codec author can make these instructions be anything at all, as long as it interfaces properly to DirectShow or whatever the Unix equivalent is.

Besides. You still have to run an installer to put the codec into your system and register it with the appropriate software components.

Re:Do you have ANY idea how this works?

[99BottlesOfBeerInMyF]

Are you for real?

Yes.

Have you ever heard of a buffer overflow?

Yes, it is the result of a bug. Proper input validation when coding fixes most of these. For the rest, a MAC system like I described mitigates their effects. So data overflows a buffer and executes as the thread it overflowed. With a jail, ACL, or container and new chipsets, that thread is still limited to the functions of the thread it has overflowed. That means while your video codec may be executing random code instead, it still can't do much more than hand off a chunk of data to your player, which probably does not have an exploitable buffer.

The codec author can make these instructions be anything at all, as long as it interfaces properly to DirectShow or whatever the Unix equivalent is.

Which is why that codex should be properly sandboxed by the OS.

Besides. You still have to run an installer to put the codec into your system and register it with the appropriate software components.

First, you shouldn't have to run an installer. You should drop it into a codec directory and the OS should handle the rest. Second, the installer for malware is unlikely to be signed, so by default it should have very limited access to the system and thus require user interaction to do anything useful as malware. MAC and ACLs are not perfect, but they are a huge step better than nothing and would stop the vast majority of malware currently in the wild.

Re:And if you use those codecs with MPlayer on Lin

[Anonymous Coward]

No ClamAV on there?

clamscan finds all kinds of crap, Linux included.

Re:And if you use those codecs with MPlayer on Lin

[BunnyClaws]

I run Sophos AV on linux and it does a pretty decent job at scanning the system.

HELOOOOOO? VLC PLAYER! D'uh!

[ClioCJS]

I can't believe no one's mentioned VLC Player aka VideoLan ( http://www.videolan.org/ ). It has codecs for hundreds of video types (even including flash video, older quicktime, and older realmedia) BUILT IN AT THE DLL LEVEL. No need to install ANYTHING. It's open source.

FFDShow is nice, but a pain in the ass to continue dealing with WMP. Kiss WMP goodbye for 90% of your videos. Use RealAlternative and QuicktimeAlternative for the other 9%. (1% still tend to need WMP... especially malformed MPGs.)

Easy Solution

[thejeffer]

Use VLC. No codecs to install. Plays just about any video format out there, and plays them well.

Re:And if you use those codecs with MPlayer on Lin

[Technician]

Running Linux does not make you invincable.

Very true. Having unprotected connections with unknown providers of active content is risky.

It is risky to open an e-mail and it says use this key to open the attachment. I apply the same caution to any video which requires me to use this provided player to view the content.

If the video says it needs Quicktime, I should be able to go to Apple on my own and install Quicktime from the source (don't follow a provided link).

In Linux I run as a user, not an admin. It is difficult to get a drive by install on my Linux box. Running Linux does not make you invincable, but it goes a long way to putting up barriers to an infection. A condom and Linux put up barriers to infection though neither is 100% effective. Because it is not 100% effective is no reason to not use it unless you prefer abstinence as an alternative.

OMG! Viruses!

[AeroIllini]

Dear Lord! Are you saying that there are actually programs available for download on the internet that might be harmful to your computer, which might also be disguised as something else?! I've never been so outraged in all my life!

People will install anything if it promises naked pictures. How is this news?

it's all about trust...

[wzzzzrd]

...it's that easy. if you use an application like windows media player which downloads codecs on it's own, you get what you deserve. honestly, all this "automagically download stuff if needed" bs should be avoided. i use windows sometimes, and i always use decent players like vlc or mpc. i cannot play a video due to a missing codec? a little google and i know which codec i need and i can decide wether it's trustworthy or not. i think at this point there's a real difference between windows and GNU/ Linux (and i mean GNU linux like debian): apt-get does kinda the same thing, downloading and installing dependencies on demand, just like windows does, but the difference: if apt-get would ever try to install spyware or trojans, the community would cry out loud and debians reputation is a thing of the past. no matter how silly the debian folks sometimes behave (iceweasel ftw), i think i can trust them.

Re:And if you use those codecs with MPlayer on Lin

[Fordiman]

I just don't bother executing that shit. Fact is, if you're after media, and you're asked to download a program, chances are you're being scammed.

Does this line of thinking apply to iTunes and Vongo? Well, for me it does. They're getting you to pay for DRM'd content. Sounds scammy to me.

Re:And if you use those codecs with MPlayer on Lin

[Fordiman]

Meanwhile, we're talking about using binary codecs, which MPlayer does without Wine's interference. The codec could easily cause havoc, but it really has no way of knowing it's under Linux, and would most likely fail to do whatever it attempts (the whole device infrastructure is different). Of course, one could be written specifically to be able to operate in linux, grabbing on to /dev/tty*, for example. You know, if it can even do an fopen.

Viral Videos That Really Are Viral

[JohnVanVliet]

all the more reason to use mplayer on windows ,but win.media player KEEPS resetting it's self as the defoult player !!!!! agggg!!!!!!!!! on my dule boot with fedora 6 .However linux is the os i use on the web if i am not at the grad lybrary , and those pesky buges won't run in SeLinux

Re:And if you use those codecs with MPlayer on Lin

[X0563511]

On the contrary, getting things to run in Wine is hard, because we cannot see what the code of the program and as such cannot recreate the perfect environment for it to run in easily.

Designing something to work in wine would be much easer, as you know what wine does, at what time, and with what resources.

In a way, writing a virus to exploit wine to plant a different Linux virus on the host, would be easier than using a worm to drop a trojan on a windows box... and that happens all the time.

Re:And if you use those codecs with MPlayer on Lin

[marcosdumay]

The answer here is NO, your Linux box is not in danger.

You know... Windows malware don't count on a stupid user that much, on this case the Linux user is safe simply because MPlayer doesn't go out at the net dowloading and running any codec that a movie tell it to.

I always suspected....

[Anonymous Coward]

When Media Player tries to download a codec or a license key from a site called http://1928398452.com/ (or something like that), it is obviously up to no good...

-jl

The solution

[djelovic]

Having access to the source code is not a solution to this problem. Ken Thompson has demonstrated that in his paper Reflections on Trusting Trust twenty years ago.

To really fix the problem we need to leverage the one thing that all modern operating systems (including Windows) do right at the core level - access control. Why would anybody want to run a codec at the privilege level of the program that's using it? Why not run it under an account where it can't touch anything except its input and output streams? (This doesn't have anything to do with whether you are logged in as admin/root. Even if you are not an admin you don't want the codec to upload your documents somewhere.)

A related issue is installation programs. We need to make these declarative instead of executable. As it is right now, you run installations as an admin/root, and give them the rein to do anything. God knows what goes on in those MSIs and makefiles. If these were declarative then setups would declare at the beginning what kind of access they need (simple installation, shared component installation, mucking with the system, codec, &c) and you would be able to make a finer grade decision on whether you want to let them run.

Dejan

Why disguise a legit codec as a nuisance program?

[macraig]

Some of the codecs do help to play clips, but others are disguised as a variety of nuisance or malicious programs.

Wouldn't that make people less likely to download and install it, not more so?

Now, disguising a nuisance program as a legit codec, OTOH, might be pretty brilliant; suppose anyone has thought to try that?

Re:And if you use those codecs with MPlayer on Lin

[morgan_greywolf]

Meanwhile, we're talking about using binary codecs, which MPlayer does without Wine's interference.

1. MPlayer makes use of Windows codecs through the use of Winelib.
2. If you read TFA, you'd know that some of the malware came in the codec, while others came in the installer (i.e., a secondary program installed at the same time as the codec)
3. Yes, the codec does have a way of knowing it's running under Linux if the writer of the codec designed it.
4. Grabbing on to /dev/tty* is of limited use in a system that's running X or if all logins are via sshd.

Re:And if you use those codecs with MPlayer on Lin

[The Cisco Kid]

My 'favorite media player' isnt designed so stupidly as to ever display such a message. If it doesnt understand a given media file, it just produces a meaningful message to that effect, and exits. Then, I can go look at sites I trust to see if what it identified as needed is a real codec, and where to get it.

Snow Crash?

[religious freak]

OMG, the Metaverse is going to core dump and we're all going to be taken over by a bunch of religious zombies... Save us, Uncle Enzo!

Re:And if you use those codecs with MPlayer on Lin

[tehcyder]

"if (OS == LINUX)" code.

Ah, so *that's* why you need to say GNU/Linux, it's an anti-virus thing.

Re:HELOOOOOO? VLC PLAYER! D'uh!

[tehcyder]

(1% still tend to need WMP... especially malformed MPGs.)

Why do you think WMP would be especially good at playing crapped up MPGs? I've always found it fussier than the alternatives.

Re:HELOOOOOO? VLC PLAYER! D'uh!

[ClioCJS]

well.. basically... take some porn movie sample that's put on the web as 10 separate mpgs. Use copy /b to binary copy the files together to a single file. VLC quits after part 1, despite the fact that the other 9 parts are there. WMP plays fine.

(Don't tell me that's not the proper way to append files and VLC is just obeying the standards. Sometimes strictly obeying standards is bad. For example, I wrote a script that generates an HTML page containing every image in the folder -- for local viewing, no webserver. I do img href=c:\whatever.jpg. Worked for FIVE YERAS. Along comes firefox, and its strict standards interpretation gives me a page of "X"s -- it wants file://c|/whatever.jpg. Ugh. I'm not touching my script and writing in urlencode stuff. If href is a valid filename, just show it to me! I'm sticking with IE for those situations.) But I digress.

I've also found certain WMVs play in VLC, but the keyframes only register in WMP. Which makes more sense because it is *windows* media video (shudder).

Also, pretty often VLC wont show it in the right aspect ratio, but WMP will. I'm aware that VLC has it's own aspect ratio controls, but sometimes it just isn't right unless you play it in WMP...

I've probably tested more files of different formats on more players than 99% of people on slashdot, so I've run into a lot of uncommon thigns. Like FLVs that play with green verticle lines in VLC, but play fine with FLVPlayer (which I hate because it wont do fullscreen).

Re:And if you use those codecs with MPlayer on Lin

[Fordiman]

1. Please read the MPlayer documentation, or, at the very least build it for yourself at least once. It doesn't use winelib. Feel free to correct me if you can find it anywhere on
2. The dangerous part is the codec. No self-respecting linux user would run a random windows program as root, but they may not think twice about the codec (figuring that it's properly sandboxed by mplayer - which it is).

3. It may, but try, just once, to have an exe link to an elf library. Even if it found out, the codec couldn't even know how to link into libc6, at least not by any method I can think of.

4. True. But it's also not the only way to capture the keyboard. I was giving an example of a way to spy.