Slashdot Log In
Crackers Tune In to Windows Media Player
Posted by
CmdrTaco
on Tue Jan 11, 2005 12:00 PM
from the hate-when-that-happens dept.
from the hate-when-that-happens dept.
jamshedji writes "Crackers are using the newest DRM technology in Microsoft's Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
It's like sun on your wedding day? (Score:5, Insightful)
Not quite ingenious but certainly not ironic. Perhaps if they were loading copyrighted materials such as movies and music onto your machine while you were attempting to download the license for DRM *then* it would be ironic.
The sad thing is that 99% of Windows users are likely telling WMP to install these licenses automatically when they try to play a media file. It's the "popup addiction" at work. People can't stand popups and anything to get them out of the way for good is they way they want to go.
This is going to become yet another excuse for trusted computing and single codec repositories. "Look! You are being infected by those bad sites on the Internet! Want protection? Use trusted computing and you'll never have a problem again! Just sign here, here and here. Pay here and connect here. Ahh, isn't that better?"
Re:It's like sun on your wedding day? (Score:3, Funny)
True, but sad. (Score:5, Insightful)
Parent
Trusted Computing Will Make It Worse (Score:5, Insightful)
As soon as a bug is found in a trusted computing architecture, which WILL happen, things will get a whole lot worse for the average user. Spyware will be created which your hardware refuses to allow you to remove, even with a boot disk or safe mode. Your computer will refuse allow you to install anti-virus and spyware cleaning tools. The spyware will install a certificate with high trust levels for spyware vendors.
Even if no bug is found, companies like AOL have proven they're willing to sell out their customers by bundling adware with AIM without disclosure. This will likely create an initial hole which can be opened up much wider.
Issues like this are killing Windows. I learned my lesson a few years ago that almost no shareware or freeware can be trusted. This makes Windows a lot less useful and is one of the many reasons why I usually run linux on my desktop.
IMHO, trusted computing will only hurt Windows' usability by the average user.
Parent
Re:It's like sun on your wedding day? (Score:4, Insightful)
"In this case, they're using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys,"
To me this just proves that trusted computing is a bad deal. The more control you take away from the end user, the more control you give to the people who would hurt you.
Parent
Re:It's like sun on your wedding day? (Score:5, Insightful)
Any DRM implementation is more likely to be exploitable in ways such as this. DRM is more likely to be insecure from the user's standpoint because it's designed from the ground up with somebody else's security as the highest priority. And once the software has been exploited, it has the potential to be highly troublesome because the malicious code now has access to a system that was designed to prevent the owner of the computer from tampering with it. The more effective the DRM is, the more dangerous it is to the user.
Perhaps I'm being overly paranoid, but I find this to be quite alarming.
Parent
Re:It's like sun on your wedding day? (Score:5, Interesting)
I wonder how long until you're no longer given the choice to opt out of DRM at install, though.
Parent
It's a bit like IE and activeX except.. (Score:5, Insightful)
This will become the new ActiveX.. I can see it already..
Simon.
Re:It's a bit like IE and activeX except.. (Score:4, Informative)
When the user clicks yes, then their system becomes infected.
So if you don't trust the video source, or set WMP to not download codec you will be safe
Parent
Re:It's a bit like IE and activeX except.. (Score:4, Informative)
Parent
Re:It's a bit like IE and activeX except.. (Score:3, Informative)
Nothing to do with codecs. From TFA:
Re:It's a bit like IE and activeX except.. (Score:4, Interesting)
In other words adware!
WMP IS ADWARE AND SPYWARE BY MS'S OWN DEFINITION AND DESIGN!
How much more obvious does it get?
One could argue for MS products opening their own Web page for some reason, but some other random company's Web page? I could see providing a URL maybe, but actually going to the site without your permission?
Tell me again MS doesn't want to control your machine!
Parent
Re:It's a bit like IE and activeX except.. (Score:5, Informative)
Parent
No logic (Score:5, Insightful)
Re:No logic (Score:3, Insightful)
To make it easier for users to watch movies. Codecs to watch movies are available all over the place but a generally dumb Windows user wouldn't have the faintest idea where to get that.
Microsoft was attempting to make their media viewing a bit easier by telling them the codec wasn't installed (rather than displaying their famous acid-trip screen saver) and that WMP could attempt to install it
Re:No logic (Score:4, Insightful)
Microsoft was attempting to make their media viewing a bit easier by telling them the codec wasn't installed (rather than displaying their famous acid-trip screen saver) and that WMP could attempt to install it for them.
You are incorrect. This exploit has nothing to do with fetching codecs. It is a feature that will open a web page specified by the creator of the movie or song file, that is intended to allow the user to buy a license to use the media. Basically it is a "feature" whereby media player will see a movie, notice you don't have a DRM key for it, and open a web page so that you can buy said DRM key. Unfortunately, like usual MS was completely blinded by dollar signs and did not consider that arbitrary files could direct the user to any old web page, and since IE is full of holes, this makes it pitifully easy to use a media file as a trojan.
I have not looked at this exploit more than superficially so I am unsure if the media player will always open the page in IE, or if setting Firefox as your default browser will save you. I also do not know with what privilege level IE connects, at a guess I would think it is as you with the lowest security setting for that page, but it could be your default, or connect as "root." Someone also mentioned that there is a setting to disable this, but it does not seem to work.
It's partly the users' fault for
...expecting their computer to be reasonably secure by default, and not silently install programs from anyone who can lure you to a particular web page. Also for assuming that the computer equivalent of a stereo and VCR will not connect you to random places on the internet and randomly install programs. If Sony made it's consumer appliances like this, when you put a VCR tape in from your neighbor you would have to worry that it might make extra ads appear in the middle of your TV screen from that point on.
Parent
Re:No logic (Score:4, Interesting)
And it does. Unfortunately, it also makes malicious computer use easier and more transparent. Microsoft has ignored that aspect to their design philosophy, and it's become the source of many highly-publicized security issues.
Parent
Re:No logic (Score:5, Informative)
In theory, if you download an MP3 with DRM enabled, Windows Media Player will search your computer for the license. If it doesn't find it, it will go to the URL specified in the MP3. This is part of the DRM spec.
"Hackers" are just taking advantage of this, creating fake MP3s/MOVs and making those URLs go to junk-infested sites.
In WMP's defense, it *does* ask you first if you want to go out and hit the site for the DRM license. And once you get there, if you're running SP2 then security is no different than any other mailious website you may visit.
SP2 should block the popups, and give you a much more informative warning if the site tries to push software onto your computer.
Parent
Crackers like... (Score:5, Interesting)
What's with /. running months old news? (Score:5, Funny)
Re:What's with /. running months old news? (Score:4, Funny)
Seems like a "5, Funny" joke is lurking in there somewhere...
Parent
Re:What's with /. running months old news? (Score:4, Funny)
Parent
Solution (Score:3, Informative)
Surprise surprise... (Score:5, Insightful)
Is it really worth sacrificing the safety of media files so that video players could launch web pages and other code? Another example of Microsoft trying to add usability, whlile sacrificing security. There's no way they couldn't have known about this security flaw.
Re:Surprise surprise... (Score:3, Insightful)
Presumably that was before you learned things.
All data is safe, processing untrusted data is potentially dangerous, particularly if it is automatic.
Email is just plain text but look how many buffer overflows various email clients have had just parsing it
http://www.google.co.uk/search?q=email+parsing+bu f fer+overflow [google.co.uk]
and is has nothing to do with OSS/CS
Re:Surprise surprise... (Score:3)
This is why I use Linux.. (Score:4, Interesting)
But really, Windows XP does provide a way to keep users from installing just any software, that is by having a seperate administrator user and do you surfing and P2P downloading using a "limited" user account.
I went to visit some relatives a couple of weeks ago and I found 250 dialers, spyware and malware programs on thier computer using Spybot. It was unbelievable!
Someone's got to say it (Score:5, Insightful)
They aren't using Windows Media Player to install spyware. They are using WMP to get users to click on a link that takes them to a webpage where, presumably, the user's browser is compromised.
Give the proliferation of spyware *without* this new fishing technique, I don't understand the significance of this. People find spyware all by themselves, they don't need any help.
Not only hackers! (Score:5, Interesting)
Crackers? (Score:5, Funny)
He'll be pissed.
Winamp TV had this problem too (Score:5, Interesting)
Please, not every app in the known world needs to launch a freakin' web page, etc.
Please clear this up for me... (Score:3, Interesting)
How could DRM work without inherently 'spying' on the user/victim?
WMP-out (Score:4)
won't work (Score:3, Interesting)
The problem is that Winamp (IIRC) uses DirectShow and standard Windows codecs for playing movies; WMP is also essentially a gui front-end for DirectShow. (It's just like Linux where you have xine-lib with its plugins, and all sorts of guis for it - xine-ui, kaffeine, totem etc). My guess is that the Windows Media DRM is implemented at the codec level or in the DirectShow pipeline, and not in the media player - otherwise, the DRM would be trivial to circumvent. The only
Re:WMP-out (Score:3, Interesting)
Better replacement for WMP (Score:5, Informative)
Windows media player like it should be. Low resource usage, plays dvds and any file you have the codecs for installed, without any network access at all. (Unless you're playing a stream or course)
Simple rule of thumb (Score:5, Funny)
Don't buy products from Microsoft!
There is one exception: The Microsoft Optical Wheel Mouse is a great product. You can't fuck up a mouse, though.
Wait, Apple's round one-button mouse.
Now, that's a deal: Apple could learn from M$ how to design mice, while Steve explains to Bill what an Operating System is.
Glad to see DRM is protecting digital rights (Score:3, Interesting)
Instead, it turns out that DRM is simply doing it's job - protecting the digital rights on content providers by punishing those people who attempt to gain access to unathorised media.
Here's my take, I'm pretty sure that I'll be safe wether I run linux or windows (I run both) since I am not
If you engage in pirating, you deserve the cannonball to your vessel; I, for one, feel no pity.
Hastening The Death Of The PC (Score:4, Interesting)
The next generation gaming consoles may be ready to become the easy to use box in the living room that is easy to use and never gets infected by viruses or spyware. If this happens, home PC sales will plummet! Couple these boxes with HDTV and high quality sound systems and it's game over for the PC. Slashdotters may be able to cope with the nonsense, but most people are going to take the easy way out, especially if the price of admission is low. As for me, I'd love to see a really good web browser on Sony's PSP, then I could do my mindless surfing in the living room on a reasonably good display.
I guess that explains that (Score:4, Interesting)
As part of the process I was tasked with fixing the 3 XP laptops that were "not working" or "too slow".
Sure enough, I found that they all had spyware - but one had 52 viruses on it.
The best part was that his wife (it was her laptop) said to me "oh that is odd because my IT person from work JUST scanned that two days ago - so I hardly think that I got 52 viruses in two days."
I tried to be polite but essentially told her that she might want to look into getting a better IT person.
One of the viruses that she had kept spawning instances of the media player and I couldn't figure out why... now I see why I guess.
(technically some of the viruses were trojans/worms/spyware, so I guess I should just say "malware")
This automatic downloading has got to stop (Score:5, Insightful)
If you have to run Microsoft, one solution is to back off to Windows 2000. You run Windows 2000. Windows XP runs you. Many corporate installations refuse to go with XP for that reason.
It's not just Microsoft, either. Remember that DRM-protected CD that changed the firmware on Apple CD drives so the machine would never work again? (And remember Apple refusing to fix it under warranty?)
Re:Unsuspecting??? (Score:5, Insightful)
What does Firefox have to do with ending Spyware via WMP? Absolutely nothing. Last time I checked Firefox opened WMP on Windows machines when you attempted to play a media file.
Hmm.
Now maybe if you had suggested some little known media player that didn't automatically install codecs after you clicked "don't ask me again, just install" then maybe your post would have been worth something.
At least RTFA.
Parent
Re:Unsuspecting??? (Score:3, Informative)
Well, to be precise it opens which ever media player is associated with the media file you are trying to open. You can also override this on a per-filetype basis by specifiying a different handler for the file under the "Downloads" section of the Options box - the section titled "File Types". Whether your motivation for switching to Firefox was security, features, web standards or because it's FOSS, then the same motivation should apply to WMP t
Re:Unsuspecting??? (Score:3, Informative)
Seriously I haven't felt the need to install any AV player after MP Classic and mega codec pack from kazza-lite. Also use real player alternative and quicktime alternative much less resouce use and no phoning back to home.
...so, when did Firefox become... (Score:5, Insightful)
So, in other words - use VideoLAN
Parent
Re:Unsuspecting??? (Score:3, Interesting)
If you want a decent open source media player, choose VLC [videolan.org]. It works great on Win32, Linux & OS X. Works well supporting CDs, DVDs, AVI, DiVX, MP3, Ogg and just about every other media format known to man - except protected WMA.
So if the exploit relies on dangling a "carrot" in the shape of some free pr0n if you download some licence into WMP, VLC won't protect you from yourself and doesn't offer comparable functionality.
Re:Hackers, not Crackers. (Score:5, Insightful)
Parent
Re:No no no, all wrong (Score:5, Insightful)
Parent
Re:You know my solution. (Score:5, Insightful)
In general "advanced" formats will require downloading software. The fact that the "advance" here is DRM is almost immaterial, except perhaps for the fact that some people believe they're downloading a license rather than software. But Windows asks explicitly if you want to download and install the software. You get a warning, you have to say, "Yeah, I want that piece of malware." The message may not be clear enough, and since there are cases where you do want it you're asking a naive user to make a fairly sophisticated security judgment, but it is there, and the malware can't bypass it. It doesn't need to.
To my knowledge Linux doesn't have a good solution to that problem, either. If you need software to play that movie/music, it's up to you to verify that the software isn't malware. Linux users escape this problem largely because there aren't enough of them to make it worth the malware writer's effort (as well as the fact that Linux users tend to be better educated and would answer "Hell no!" to the question if asked).
What's needed here is a security sandbox. Download the codec but don't give it permission to do anything except take stuff from one place in memory and dump it to another, or access a limited direct-to-video API. No network access, no disk access. I'm not aware of any particular Linux security sandbox.
Microsoft does have its own, in its C#/CLR, though clearly that hasn't made it to the point of writing codecs yet. And it may not, since these are performance-intensive apps and virtual machines impose overhead. I've seen codecs written in Java, and they're tolerable but not what you'd choose.
Parent
Re:You know my solution. (Score:4, Insightful)
Parent