Online Videos May Conduct Viruses

Technical Writing Geek writes "A report on threats via the Internet released by a Georgia Tech research center indicates online video may be a new avenue of attack. As the popularity of flash media continues to explode, hackers may be targeting embedded video players and more traditional video downloads with worms and virii. 'One worm discovered in November 2006 launches a corrupt Web site without prompting after a user opens a media file in a player. Another program silently installs spyware when a video file is opened. Attackers have also tried to spread fake video links via postings on YouTube ... Another soft spot involves social networking sites, blogs and wikis. These community-focused sites, which are driving the next generation of Web applications, are also becoming one of the juiciest targets for malicious hackers.'"

Comments

Dammit!

[djasbestos]

And I thought my porn was safe with AV and spyware/adware blockers and cookie cleaners and...

It's Indevitable.

[TechyImmigrant]

Every new application that places a large footprint of code in the line of fire on the internet will be subject to attack.

Media apps are big, hairy and process gobbets of data straight from the attacker's server. What did people expect?

Anyone seen any code?

[grassy_knoll]

"The next logical step seems to be the media players," Rouland said.

So, are they just guessing FLV may sometime become a virus vector? Has someone done a proof of concept?

TFA makes it sound like the Georgia Tech Information Security Center is making it up as they go along.

They don't have to be

[XanC]

What's wrong with posting MPG files for people to download? Every site these days is Flash video, or insists and assumes you're running a Web browser, wrapping their video file in Flash controls and burying the actual URL to the actual file people want to see under a dozen redirects.

All I want is the URL so I can play it with mplayer. I have no intention of putting Flash on my machine. Is that so danged difficult??

Re:They don't have to be

[satoshi1]

Yes.

Re:They don't have to be

[kebes]

All I want is the URL so I can play it with mplayer. I have no intention of putting Flash on my machine. Is that so danged difficult??

Actually it would be much, much easier to design a system that just exposed the URL for a standard video file. The user/browser could then either download it, or have a plugin that buffers and displays it inside the browser. This eliminates all kinds of problems both for the web developers and the user.

But, of course, the real reason for using Flash-based players is that it acts as a weak form of DRM. The intention is to force the user to watch the video only at the site (with ads, etc.), and to not allow the user to take the video, transfer it elsewhere (e.g. iPod), edit out commercials, redistribute it, etc.

Of course, we all know that it is possible to write a script that extracts the video... but it becomes a tiresome arms race. This is just another example of the fundamental tradeoff between the notion of "convenience" (for the user) and "control" (for the distributor). The user wants freedom. The distributor wants DRM.

Re:They don't have to be

[vertinox]

Was the first word "ninja?"

The word

[Anarke_Incarnate]

is viruses. Virii is made up. Go look it up. Viri is man, there is no "virii"

Re:The word

[Anonymous Coward]

Correct. There is no virii.

Unless you find them on your boxen.

Of course....

[TechForensics]

... you don't have to worry if you run Linux!

the plural of virus is viruses

[kcokane]

in the text: ... with worms and virii....

note: there is no Latin plural for the word
virus (means slime, basically). the expected
plural, viri, is the plural of vir (man). the
plural of virus is viruses.

There's a lot of conjecture here.

[jackpot777]

Isn't this all a bit "Schrodinger's Cat"? These virii are half-written, half not written, and we only get to know which one it is if we open the video clip of Anna Kournikova...

Would the esteemed learning establishment care to debate if we will be living on the moon, wearing shiny suits, eating meal pills, flying around with our prsonal jet-packs? I for one want to know ...or at least have someone hypothesize if such a thing may be possible.

Hmmmm.

Re:Erm

[Ucklak]

Yeah, 1996 called, they want their virus distribution back.

I guess the researchers at Georgia Tech were 11 and younger when this was done before.

Why should Flash have any kind of write access???

[G4from128k]

Why in the world should the Flash player have any kind of access/execution/write privileges on the browser's machine? I can understand that the player needs to be able to execute some form of code to create interactivity, but shouldn't this be so totally sandboxed that presents a minimal threat to the user or the OS.

This just confirms my opinion that Flash is an evil cancer on the web designed to move control of the web experience from the person browsing to the Flash author (who maybe a botnet builder).

Re: Online Video May Conduct Viruses

[bogie]

Was it a morally corrupt web site? Those are the worst kind.

Plural of virus

[Spy der Mann]

http://en.wikipedia.org/wiki/Plural_of_virus

I think that should clear it up. :)

Not new

[packetmon]

This attack vector isn't new however its spreading more and more as time progresses. What I find to be a worst attack vector are the ad servers such as Doubleclick, Akamai, etc.:

Yahoo's Right Media had Trojans in banner ads
Posted by Elinor Mills

For several weeks starting in early August, visitors to MySpace, Photobucket, Bebo and other high-traffic Web sites were exposed to banner ads that contained Trojan horse software that could wreak havoc on a computer.

Web security company ScanSafe tracked the malicious ads back to Yahoo's Right Media network and estimates that they ran several million times, according to The Washington Post's Security Fix news site. (source

Correction : Everything conducts Viruses

[Repossessed]

+That link suggests that it's Windows Media Player, rather than WMV, that's the problem, due to embedded IEness. It also specifically mentions quicktime as an exploitable format. It also says there are exploits in second life (that's a new one on me actually).

So, list of places windows users will probably pick up nastyware now includes... actually, anybody know of something that *won't* lead to malware with windows?

Re:Why should Flash have any kind of write access?

[gaspyy]

This just confirms my opinion that Flash is an evil cancer on the web designed [...] blah blah blah

This is just FUD - but obviously this is Slashdot so who cares about facts anyway?

The truth is that the Flash player has actually a pretty draconian sandbox:
1. A flash movie can not write to disk or execute any command. Period. It only has a "cookie" mechanism to store info on user's computer but the user can allow/deny the action and allocate a quota for that info. The cookie is saved in the user's Documents and Settings folder (and the Mac/Linux equivalent), e.g. "C:\Documents and Settings\user\Application Data\Macromedia\Flash Player\#SharedObjects\LQ93AHGQ\www.youtube.com" The flash app cannot control the location or the file name.
2. A flash movie can't simultaneously have read access from the local file system and the Internet. What I mean is - either a flash movie loads a local file (text, xml, jpg, flv, etc) or it can communicate with a site (load URL, send variables with GET/POST, invoke a WS, etc) - but it cannot do both of them. A user has to go to Adobe website and specifically trust an application in order for that app to have more access.
3. Flash movies can't read the clipboard.
4. Access to microphone/webcam is disabled by default and must be enabled on a per-URL basis.

Anyone who RTFA knows that it's not about exploits inside the video stream, it's about fake links.

Now, I'm pretty sure I just wasted 10 minutes of my time trying to dispel some myths, because the average Slashdot user is too busy hating Flash and worshiping Steve Jobs. Mod me down, or better yet, just ignore this post and keep on living inside your bubble.