Slashdot Mirror
Online Videos May Conduct Viruses
Technical Writing Geek writes "A report on threats via the Internet released by a Georgia Tech research center indicates online video may be a new avenue of attack. As the popularity of flash media continues to explode, hackers may be targeting embedded video players and more traditional video downloads with worms and virii. 'One worm discovered in November 2006 launches a corrupt Web site without prompting after a user opens a media file in a player. Another program silently installs spyware when a video file is opened. Attackers have also tried to spread fake video links via postings on YouTube ... Another soft spot involves social networking sites, blogs and wikis. These community-focused sites, which are driving the next generation of Web applications, are also becoming one of the juiciest targets for malicious hackers.'"
And I thought my porn was safe with AV and spyware/adware blockers and cookie cleaners and...
Every new application that places a large footprint of code in the line of fire on the internet will be subject to attack.
Media apps are big, hairy and process gobbets of data straight from the attacker's server. What did people expect?
Evil people are out to get you.
So, are they just guessing FLV may sometime become a virus vector? Has someone done a proof of concept?
TFA makes it sound like the Georgia Tech Information Security Center is making it up as they go along.
A Human Right
What's wrong with posting MPG files for people to download? Every site these days is Flash video, or insists and assumes you're running a Web browser, wrapping their video file in Flash controls and burying the actual URL to the actual file people want to see under a dozen redirects.
All I want is the URL so I can play it with mplayer. I have no intention of putting Flash on my machine. Is that so danged difficult??
is viruses. Virii is made up. Go look it up. Viri is man, there is no "virii"
... you don't have to worry if you run Linux!
Those are my principles, and if you don't like them... well, I have others.
thufferin' thuccotas! that's a dethpicable sylvesterism!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
in the text: ... with worms and virii....
note: there is no Latin plural for the word
virus (means slime, basically). the expected
plural, viri, is the plural of vir (man). the
plural of virus is viruses.
Kevin O'Kane http://www.cs.uni.edu/~okane/
Isn't this all a bit "Schrodinger's Cat"? These virii are half-written, half not written, and we only get to know which one it is if we open the video clip of Anna Kournikova...
...or at least have someone hypothesize if such a thing may be possible.
Would the esteemed learning establishment care to debate if we will be living on the moon, wearing shiny suits, eating meal pills, flying around with our prsonal jet-packs? I for one want to know
Hmmmm.
Shiny. Let's be bad guys...
Yeah, 1996 called, they want their virus distribution back.
I guess the researchers at Georgia Tech were 11 and younger when this was done before.
if you steal from one source, that is plagiarism, if you steal from many, well, that's just research.
Why in the world should the Flash player have any kind of access/execution/write privileges on the browser's machine? I can understand that the player needs to be able to execute some form of code to create interactivity, but shouldn't this be so totally sandboxed that presents a minimal threat to the user or the OS.
This just confirms my opinion that Flash is an evil cancer on the web designed to move control of the web experience from the person browsing to the Flash author (who maybe a botnet builder).
Two wrongs don't make a right, but three lefts do.
Let's leave the MS-apologist spin out of the summary. Video has nothing to do with it:
It's the WMV format that conducts the viruses.
Was it a morally corrupt web site? Those are the worst kind.
If you wanna get rich, you know that payback is a bitch
http://en.wikipedia.org/wiki/Plural_of_virus
:)
I think that should clear it up.
This attack vector isn't new however its spreading more and more as time progresses. What I find to be a worst attack vector are the ad servers such as Doubleclick, Akamai, etc.:
Yahoo's Right Media had Trojans in banner ads
Posted by Elinor Mills
For several weeks starting in early August, visitors to MySpace, Photobucket, Bebo and other high-traffic Web sites were exposed to banner ads that contained Trojan horse software that could wreak havoc on a computer.
Web security company ScanSafe tracked the malicious ads back to Yahoo's Right Media network and estimates that they ran several million times, according to The Washington Post's Security Fix news site. (source
Infiltrated dot Net
Why is this posted as a supposedly novel discovery ?
...)
A previous post allready mentioned WMV format has an on-purpose function build-in that lets it "phone home" (and retrieve whatever code it likes) without as much as a peep to the user.
The real issue here is not that some kind of "information" (movies, PDF's, etc) could harbour methods to retrieve (or even contain) the actual malicious code, but how the creators of those methods think that its a good idea to let their displaying-software "phone home" 1) whenever it likes 2) without notifying the user 3) without offering a way to disable it (it should be off by default if you ask me
http://www.youtube.com/watch?v=eBGIQ7ZuuiU
If for example a wmv file really contains and mpeg with some junk, is it enough to rename that whole file .mpeg or can you actually remove the junk. Something that does like a
..except in a windows utility (or command?!.)?..
$ cat wrapped.wmv | grep -v "http://spawnsomecrap.com/crap.html" > clean.mpeg
It's a little bit more subtle than that. Here is a simple example: there could be a section of the file that is supposed to be 100 bytes long, null terminated. The program could read it in but some joker put 200 bytes and a null there instead and the program dutifly reads all 200 bytes into a 100 byte buffer. If the size isn't checked you could overflow the stack, overwrite the return pointer, and cause the function that read the bytes return execution into some bits of code that are storred in the buffer. Think of it as hijacking the execution process.
Most media readers don't actually execute the media.
Well, except for the embedded URL feature in Windows media... and Flash ActionScript... and...
Oh dear.
+That link suggests that it's Windows Media Player, rather than WMV, that's the problem, due to embedded IEness. It also specifically mentions quicktime as an exploitable format. It also says there are exploits in second life (that's a new one on me actually).
So, list of places windows users will probably pick up nastyware now includes... actually, anybody know of something that *won't* lead to malware with windows?
Liberte, Egalite, Fraternite (TM)
Good security starts from the design phase. If it was not meant to be hacked it should not be hacked. Security holes are mainly the fault and the responsability of the people who designed those buggy pieces of software.
And yet we see the media always blaming "hackers". Sure, they're assholes who try to break and enter. But it's like a bank leaving its vault wide open and allowing anyone in, and then complaining that some people stole the money.
Why don't the programmers fix the security holes? Why do they allow the holes to exist in the first place? Nobody seems to ask those questions. I suppose "hackers are at it again" makes better headlines than "bad engineers are at it again".
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
This is just FUD - but obviously this is Slashdot so who cares about facts anyway?
The truth is that the Flash player has actually a pretty draconian sandbox:
1. A flash movie can not write to disk or execute any command. Period. It only has a "cookie" mechanism to store info on user's computer but the user can allow/deny the action and allocate a quota for that info. The cookie is saved in the user's Documents and Settings folder (and the Mac/Linux equivalent), e.g. "C:\Documents and Settings\user\Application Data\Macromedia\Flash Player\#SharedObjects\LQ93AHGQ\www.youtube.com" The flash app cannot control the location or the file name.
2. A flash movie can't simultaneously have read access from the local file system and the Internet. What I mean is - either a flash movie loads a local file (text, xml, jpg, flv, etc) or it can communicate with a site (load URL, send variables with GET/POST, invoke a WS, etc) - but it cannot do both of them. A user has to go to Adobe website and specifically trust an application in order for that app to have more access.
3. Flash movies can't read the clipboard.
4. Access to microphone/webcam is disabled by default and must be enabled on a per-URL basis.
Anyone who RTFA knows that it's not about exploits inside the video stream, it's about fake links.
Now, I'm pretty sure I just wasted 10 minutes of my time trying to dispel some myths, because the average Slashdot user is too busy hating Flash and worshiping Steve Jobs. Mod me down, or better yet, just ignore this post and keep on living inside your bubble.