Slashdot Mirror
Netflix Users In Danger of Unknowingly Picking Up Malware
An anonymous reader writes "Users of Silverlight, Microsoft's answer to Adobe Flash, are in danger of having malware installed on their computers and being none the wiser, as an exploit for a critical vulnerability (CVE-2013-0634) in the app framework has been added to the Angler exploit kit. The vulnerability could allow remote code execution if an attacker hosts a website that contains a specially crafted Silverlight application that could exploit this vulnerability and then convinces a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements."
You'd think something like Silverlight would automatically upgrade itself.
It will, assuming that it's given a critical priority within Windows Update and the user has their machine set up to automatically download and install updates.
Come on, this is basic Windows stuff. Can we get someone on the Slashdot staff that has actually some experience of the operating system in use by 96% of the population please?
Avantslash - View Slashdot cleanly on your mobile phone.
From the related MS13-022 security bulletin: "Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. "
Unless you're one of those "smart" people that use windows but disable windows update ...
I know there's been alot of bad movies lately... But malware? Really? That's harsh.
Isn't this title just totally misleading? Although Silverlight never enjoyed the popularity of Flash, it's not like Netflix is the exclusive user of Silverlight...
good news! all users that dont use Netflix will be unaffected. I can only surmise that this malware replaces all movie descriptions with "It stinks." and a rating of one star.
Anons need not reply. Questions end with a question mark.
Tell me, when is the last time you knowingly were infected with malware?
Active content executes code in the user's computer!
C'mon, folks...
Really? Why is this on front page of Slashdot? A vulnerability that was patched months ago via windows updates is now an issue?
For plugins like silverlight that run code rather poorly sandboxed, you should lock them to a whitelist, so that only web sites you have preapproved can use them.
Additionally, you should only run them on an unpriviledged user. (Something many Windows users don't do with anything as a regular practice.)
These two measures won't eliminate your risk, but they will dramatically reduce it.
Perhaps Silverlight has become self-aware and assumes that any upgrade would involve Microsoft trying to kill it off.
And this is specific to Netflix users?
I don't get it.
Back when I used to be able to stream Netflix (I since changed my account to the 3 DVDs at a time plan instead), I gave Silverlight a try. After Silverlight was installed, my video capture device with WinDVR suddenly stopped working. Suspecting Silverlight was the culprit, I set up the video capture device on a test box, and verified that it worked. Then I installed Silverlight there, and sure enough, no more video capture capability. Removed Silverlight and eradicated all traces of it from the system, and my hardware was once again working properly.
That was when I invoked the hardware owner's right. The ability for any publisher's software to run on hardware that I own is a privilege, not a right. If your product interferes with the rightful and proper operation of my property, then its privilege to exist on my system is revoked permanently.
Do not fuck with my hardware or any other software that I have installed, or you will not be permitted to run on any systems under my control, and word of your dipshittery will be passed on to others, so that they can be made aware that your software is malware.
This space unintentionally left blank.
Shouldn't this be Microsoft Windows users? My PS3 isn't going to get malware.
Politics; n. : A religion whereby man is god.
I mean if some random shit "security blog" posts a trumped up story to try and get traffic, it is Slashdot's DUTY to repeat it here, with no checking or verification! After all, better everyone is scared of their own shadow than informed about security.
Seriously this is just pathetic. As I said: This is some random ass site that is trying to get people to come and read, and it worked. By making a scare story about how Netlfix users on Windows are vulnerable they managed to get some Linux fanboy to submit the story to Slashdot. The editors then did what they do, which is to say NOT EDIT and just posted it. Great success for shit site, they now got a bunch of undeserved traffic.
What is sadder is how uninformed this makes all involved look. the statement of "You'd think something like Silverlight would automatically upgrade itself." Yes, it DOES you fucking moron. One thing you have to give MS is that Windows update will patch all their stuff for you. Let it do its thing and you get security updates, as they are released. You don't need to pay attention or anything, it'll just happen. This includes things not installed by default like Silverlight, or older versions of the .NET runtimes.
This is just a massive pile of fail. It is not news, not even really old news. There was a bug, they patched it. This would be "how shit works", or at least how it should.
http://www.defectivebydesign.org/netflix
Users of Microsoft platform are getting infested with malware....
If you want to be "safe" you have either to make sure that you have a very well maintained platform, and some smart firewalling setup that will passivelly monitor your connection and ping you when suspicious trafic is happening.
Or not use windows, and be reasonably prudent.... ...
But then you will not get your "goodies"
The main issue is that most people do not care ... they just "know" that if the computer starts to be very slow you have to reinistall everything and hope that their
double verification payment platform/banking interface is reasonably safe from man in the middle attacks... and insured so that if your account goes into red you'll get repaid eventually...
or your hardware needs drivers that follow apis and don't assumed their funky behaviour won't be screwed over by any update to any library. Silverlight did not (could not) fuck with your hardware. Your hardware ahs shit software support (and it's either the vendors or your fault)
As a Roku owner this affects me how? Who uses a PC to view Netflix content? Yes, it's possible, but it's not the best way.
Windows is finally usable at last.
And then came Windows 8....
That I'm right, and you don't like it, doesn't mean I'm a troll.
Have ya looked at Apple Launchpad recently? Or maybe you remember At Ease, perhaps? Both of these Apple products look exactly like a Windows 8 Start Screen, thank Apple.
1) This has nothing to do with Netflix. I am a Netflix user and I suspect that my Roku is not affected by the vulnerability in question.
2) Silverlight *does* get updated with automatic updates.
3) The vulnerability in question was fixed in March (MS13-022).
This is why I have plugins disabled by default and enabled only for certain "trusted" sites. For Silverlight, the only site that can run it is Netflix. This obviously doesn't protect you if your "trusted" site is compromised, but it does mean that browsing to some random website doesn't automatically infect you.
Sorry, but this is just senseless hyperbole. Malware can be picked up from ANY website, but mentioning Netflix by name is just a design at whipping up a senseless panic.
Fuck you, Slashdot.
I'm disappointed, leaving.
"Users of Silverlight, Microsoft's answer to Adobe Flash"
Ah! There's your problem, right there.
WARNING! both TF And the /. title are nothing more than sensationalism. Nothing in TFA, which is quite brief, specifically says Netflix users are being targeted. Only that Netflix uses silverlight which has a vulnerability. Its like saying "Newgrounds (pretend it's 6+years ago and still relevant) users are in danger of being infected with malware" when its all users of flash. *BUT* since silverlight and flash are web technologies which have fallen out of favor, Netflix users are guaranteed to have it installed as it is not included by default with Windows and unnecessary for 99.9999%+ of all web content. I have never installed it and I think only once have I seen a website that needed it. I don't use Netflix either.
Maybe its time Netflix invested in HTML5 and other open, modern, cross platform standards.
There is only one reason I have Silverblight installed on my OS X laptop, and that's the (laggy as fuck) Harmony remote configurator. Since that's the only thing I have which uses that crapware, I have the extension disabled in my web browser unless I'm actually using it.
The Harmony remote is such a total piece of crap, and that Silverblight configurator crapplet doesn't make it any better. The best part is when I drop it, its batteries bounce and it resets and thinks all devices are off. Fuck you very much, Logitech. If it weren't for some codes that I couldn't discover otherwise for when I eventually make my own damn remote (someday when I have enough free time), it would be completely worthless to me.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
I mean if some random shit "security blog" posts a trumped up story to try and get traffic, it is Slashdot's DUTY to repeat it here, with no checking or verification! After all, better everyone is scared of their own shadow than informed about security.
Well, around here there is a massive reading comprehension fail in submitters so that may be a big part of this submission. For example, if someone somewhere writes an article that says basically "Not X. Definitely not X. It may be A-W, Y or Z but it's definitely not X. Anything but X." then the submitter will post and scream "X! They said it was X! The sky is falling! It's X!!!". It does get old.
0.0.0.0 peragretisque.yevgenimalkin.com
0.0.0.0 yevgenimalkin.com
Add those to your hosts file - since "what you can't touch, can't hurt you"...
APK
P.S.=> Easiest & BEST way to build a custom hosts file (that adds more layered security, speed, reliability, & even anonymity (to an extent only on the latter)?
Hosts do more w/ less (1 file) @ a faster level (ring 0) vs redundant browser addons (slowing up slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ OS, & 1st net resolver queried w\ 45++ yrs.of optimization):
---
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
(Details of hosts' benefits enumerated in link)
Summary:
---
A. ) Hosts do more than AdBlock ("souled-out" 2 Google/Crippled by default) + Ghostery (Advertiser owned) - "Fox guards henhouse", or Request Policy -> http://yro.slashdot.org/comments.pl?sid=4127345&cid=44701775
B. ) Hosts add reliability vs. downed or redirected DNS + secure vs. known malicious domains too -> http://tech.slashdot.org/comments.pl?sid=3985079&cid=44310431 w/ less added "moving parts" complexity + room 4 breakdown,
C. ) Hosts files yield more speed (blocks ads & hardcodes fav sites - faster than remote DNS), security (vs. malicious domains serving mal-content + block spam/phish), reliability (vs. downed or Kaminsky redirect vulnerable DNS, 99% = unpatched vs. it & worst @ ISP level + weak vs FastFlux + DynDNS botnets), & anonymity (vs. dns request logs + DNSBL's).
---
Enjoy - she's a 100% freebie & really works + VERY well (especially considering 99% of the servers/hosts-domains used nowadays ARE hostname-domainname based since "fastflux" &/or Dynamic DNS utilizing malware-botnets etc. ARE truly FAST becoming "the norm" & have been in use for years now).
... apk
A flaming piece of shit from the word go. I can't stand it and wish Netflix would just go back to the damned Flash player. I have an older machine and can regular watch Silverlight consume EVERY CPU cycle. It seems to do with network latency - it loses it's mind.
Netflix Users In Danger of Unknowingly Picking Up Malware / You'd think something like Silverlight would automatically upgrade itself.
You can't have it both ways - you want silverlight updating or you want to stop malware being installed?
(implying silverlight is malware in a sense greater than just software)
"You'd think something like Silverlight would automatically upgrade itself."
As intrusive and time consuming as Microsoft updates are, they damn well better be updating Silverlight, FFS.
Seriously, there has to be a better way to down mod articles that make it to the front page. The firehose just doesn't cut it.
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
We get it. You seem like the classic foam-mouthed person who loves Linux and hates everything Microsoft touches. Bonus points for writing "M$ Windoze". Year 2000 called and wants your rant back.
Next time, on "Troll vs Troll"...
And then came Windows 8....
You can still run Windows 7. It will still be supported for over 6 years.
Your attempt at misdirection doesn't alter the obvious facts here.
There's a clear chain of cause and effect here.
Chances are that Microsoft's willingness to turn it's OS for office work into a glorified TV with DRM up to the gills had some impact on a device specifically designed to do things that Hollywood might not approve of.
Silverlight will happily run in a VM. So you could always go that route if you really need to.
A Pirate and a Puritan look the same on a balance sheet.
Windows is monopoly ware.
It's hard NOT to have some experience with it.
Perhaps your employer shoves it down your throat or you have to be the unpaid support tech for friends and family.
Although the idea that we haven't touched WinDOS in 7 or so years is a nice testament to the suitability of Linux. If people can fully turn their back on Microsoft, then the alternatives can't really be so bad then.
A Pirate and a Puritan look the same on a balance sheet.
The problem was with Silverlight, not with Netflix. I think the author's article title is misleading and going to scare a lot of unsavvy Netflix users...
Usually you do tend to be wiser and able to discern getting infected with malware via RCE. It tends to involve the host process crashing after executing the injected shellcode.
Dude. You may not be realizing it, but you might be waking up in the middle of night, booting up your laptop, then start fapping to porn until the batteries ran out. Sleep fapping is a serious medical condition and associated with severe skin lesions and soreness. Did it stop doing it after you got a girlfriend? Otherwise you've got to start watching more porn when you are awake.
This is a perfect example of why I never installed Silverlight. Adobe is sloppy enough with their programming, Microsoft tends to take it to the next level of actually hating their customers so I would love to watch Netflix on my Laptop/Desktop but instead don't. I was shocked to see that they were using Silverlight in that I though Netflix had good programmers who knew what they were doing.
Who cares about specific malware? Thnaks to Snowden we know Internet is Malware by itself.... Without any plugin.
Good, informative post. I've been doing this for years on all my boxes with IE installed, but most people don't even know it's possible.
Note that since IE9, you can also disable/enable ActiveX in general on a per-site basis. Tools -> Safety -> ActiveX filtering to disable it by default. It'll put a little blue icon in end of the address bar when it blocks something; you can click the icon to turn off the filtering for that site only. Less obtrusive than the "do you want to enable <SPECIFIC_ACTIVEX_CONTROL>?" (usually Flash) prompt too, which won't show up until you enable ActiveX for the site.
Come on, if the question got to +4, the answer is worth a few mod points too...
There's no place I could be, since I've found Serenity...
Doesn't Silverlight require the computer to be infected with Windows?
I'll see your senator, and I'll raise you two judges.
That's all one needs to say.
People still use netflix on a computer? do these people not own TV's or tablets?
Do not look at laser with remaining good eye.
No he cant, because 7 is less than 8 and that doesn't make him feel as good. Must have the highest number or friends will pick on me....
Did Timothy cover Unknown Lamer's shift, using Unknown Lamer's account?
Every trollism an AC posts is prefixed, in my mind, with "A. Coward whined, in a weak and cowardly voice:"
Hi twitter.
Oh you and the chair-throwing ape Sweaty B will never get it. M$ is toast and their monopoly, no matter how much you astroturf for M$ on $lashdot it will never change. M$ thinks non-free software is the way to go when free software is the future. Due to it's use of restricted boot Vista 8.1 (aka "Windoze 'Brick Edition'") is bigger failure than Windoze Vista, Vista 7 and Vista 8 combined. The xbone is poised for a bigger failure than the Nintendo Wii-u.. Internet Exploiter is also finished as free alternatives have surpassed it. The year 2000 called and wants your DRM infested, malware attracting nonfree software back. The justice department should investigate M$ for once again for it's monopolistic practices and revoke their corporate charter.
--
Friends don't help friends install M$ junk.
Friends do assist M$ addicted friends in committing suicide.