Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Online Videos May Conduct Viruses

Posted by Zonk on Tue Oct 02, 2007 11:42 AM
from the tubes-are-just-full-of-surprises dept.
Security Media The Internet Worms
Technical Writing Geek writes "A report on threats via the Internet released by a Georgia Tech research center indicates online video may be a new avenue of attack. As the popularity of flash media continues to explode, hackers may be targeting embedded video players and more traditional video downloads with worms and virii. 'One worm discovered in November 2006 launches a corrupt Web site without prompting after a user opens a media file in a player. Another program silently installs spyware when a video file is opened. Attackers have also tried to spread fake video links via postings on YouTube ... Another soft spot involves social networking sites, blogs and wikis. These community-focused sites, which are driving the next generation of Web applications, are also becoming one of the juiciest targets for malicious hackers.'"
+ -
story

Related Stories

Submission: Online videos may conduct viruses by athloi (1075845)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Online Videos May Conduct Viruses 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • I thought this was obvious...

    • Re:Erm (Score:4, Funny)

      by Ucklak (755284) on Tuesday October 02 2007, @11:58AM (#20825159)
      Yeah, 1996 called, they want their virus distribution back.

      I guess the researchers at Georgia Tech were 11 and younger when this was done before.

      • Re: (Score:3, Interesting)

        by Crayon Kid (700279)

        Yeah, 1996 called, they want their virus distribution back.

        And yet it's so damn sad to see that in 10 years the industry has still not learned to do things right.

        Good security starts from the design phase. If it was not meant to be hacked it should not be hacked. Security holes are mainly the fault and the responsability of the people who designed those buggy pieces of software.

        And yet we see the media always blaming "hackers". Sure, they're assholes who try to break and enter. But it's like a bank leaving

    • Correction : WMV conducts viruses (Score:2, Insightful)

      by Anonymous Coward

      Let's leave the MS-apologist spin out of the summary. Video has nothing to do with it:

      It's the WMV format [eweek.com] that conducts the viruses.

      • Correction : Everything conducts Viruses (Score:4, Informative)

        by Repossessed (1117929) on Tuesday October 02 2007, @01:29PM (#20826503)
        +That link suggests that it's Windows Media Player, rather than WMV, that's the problem, due to embedded IEness. It also specifically mentions quicktime as an exploitable format. It also says there are exploits in second life (that's a new one on me actually).

        So, list of places windows users will probably pick up nastyware now includes... actually, anybody know of something that *won't* lead to malware with windows?

  • Dammit! (Score:3, Funny)

    by djasbestos (1035410) on Tuesday October 02 2007, @11:45AM (#20824907)
    And I thought my porn was safe with AV and spyware/adware blockers and cookie cleaners and...

  • It's Indevitable. (Score:5, Insightful)

    by TechyImmigrant (175943) * on Tuesday October 02 2007, @11:46AM (#20824933) Journal
    Every new application that places a large footprint of code in the line of fire on the internet will be subject to attack.

    Media apps are big, hairy and process gobbets of data straight from the attacker's server. What did people expect?

    • They don't have to be (Score:5, Insightful)

      by XanC (644172) on Tuesday October 02 2007, @11:50AM (#20825019)

      What's wrong with posting MPG files for people to download? Every site these days is Flash video, or insists and assumes you're running a Web browser, wrapping their video file in Flash controls and burying the actual URL to the actual file people want to see under a dozen redirects.

      All I want is the URL so I can play it with mplayer. I have no intention of putting Flash on my machine. Is that so danged difficult??

      • Yes.

      • Re: (Score:3, Insightful)

        by UbuntuDupe (970646)
        Two words: money.

        Well, make that three: control.
      • Then they can't surround the video with ads, or do cool things like show "You would also like" after the video.

        Also, having done some work on this kind of thing, you get your videos working on the most computers without having to make users do anything if you use flash. You might not like it, but it gets higher coverage than something like an mpeg.

        • You're certainly right about ads.

          But won't most browsers talk to the default media player and play an MPG in the browser window when you click on it?

      • Maybe same reason people want images embedded into webpages so that you don't have to download them to view in a seperate image viewer?
        • That should be up to the user agent. As far as I know, media player plugins by default play video in the web page, or at least pop right up when you click on a video.

      • Re:They don't have to be (Score:5, Insightful)

        by kebes (861706) on Tuesday October 02 2007, @12:34PM (#20825693) Journal

        All I want is the URL so I can play it with mplayer. I have no intention of putting Flash on my machine. Is that so danged difficult??
        Actually it would be much, much easier to design a system that just exposed the URL for a standard video file. The user/browser could then either download it, or have a plugin that buffers and displays it inside the browser. This eliminates all kinds of problems both for the web developers and the user.

        But, of course, the real reason for using Flash-based players is that it acts as a weak form of DRM. The intention is to force the user to watch the video only at the site (with ads, etc.), and to not allow the user to take the video, transfer it elsewhere (e.g. iPod), edit out commercials, redistribute it, etc.

        Of course, we all know that it is possible to write a script that extracts the video... but it becomes a tiresome arms race. This is just another example of the fundamental tradeoff between the notion of "convenience" (for the user) and "control" (for the distributor). The user wants freedom. The distributor wants DRM.

      • Re: (Score:2, Informative)

        by mha (1305)
        Hi,

        I would like to add my opinion this time. Some time ago I started a new idea: building *multimedia* learning content. Sounds easy enough, only that I had some more goals. Among them was to build a community-based platform - as in "OWNED by the community", not a "web 2.0" startup.

        By the way, the current state is at http://letexa.com/ [letexa.com] - I'm giving the URL because you can see what I'm going to talk about next in real-life examples.

        So, I tried with HTML/Javascript. I always knew I had to use Flash vor the Vi
        • That's fine and all, and it looks like you have a neat site. You're talking about building an app for a particular platform, Flash, and that's fine; you've got some bad and good and found what works for you. My complaint is about bog-standard video being buried under Flash for no particular reason.

      • What's wrong with posting MPG files for people to download? Every site these days is Flash video, or insists and assumes you're running a Web browser, wrapping their video file in Flash controls and burying the actual URL to the actual file people want to see under a dozen redirects.

        All I want is the URL so I can play it with mplayer. I have no intention of putting Flash on my machine. Is that so danged difficult??

        No, it's actually trivially easy to have both a flash player and a simple download link. They

      • A number of things.

        a)Most users don't realize it is easy to copy the flash movies from your /tmp ( or whatever the equivalent is on windows ) and thus it acts as a weak form of DRM, forcing people to return to the site since they don't know how to download a permanent copy.

        b)Flash stores data on the client computer ( a bit like cookies ) which is used to snoo... errr... automatically obtain customer feedback.

        c)Flash lets you have all kinds of annoying banners, clickable monkeys, advert overlays, etc ...

        So i
    • thufferin' thuccotas! that's a dethpicable sylvesterism!
    • Hasn't this already been done?
      I seem to recall nefarious crackers using the myspace embedded video feature to serve up Windows Media files that took advantage of code execution in the Windows Media Player.
      Or is this just new an interesting because it's flash, instead of WMV?

  • Anyone seen any code? (Score:5, Insightful)

    by grassy_knoll (412409) on Tuesday October 02 2007, @11:48AM (#20824983) Homepage

    "The next logical step seems to be the media players," Rouland said.


    So, are they just guessing FLV may sometime become a virus vector? Has someone done a proof of concept?

    TFA makes it sound like the Georgia Tech Information Security Center is making it up as they go along.

    • Re: (Score:3, Insightful)

      by Technician (215283)
      So, are they just guessing FLV may sometime become a virus vector? Has someone done a proof of concept?

      TFA makes it sound like the Georgia Tech Information Security Center is making it up as they go along.

      The FA was short on details, but from what I've seen in online video, there are 2 probable ways this is done. Most flash video sites require scripting to be on.. Duh there is a vector right there. Other sites insist you download their viewer (Untrusted software anyone?). With an untrusted viewer and scr

  • The word (Score:5, Informative)

    by Anarke_Incarnate (733529) on Tuesday October 02 2007, @11:50AM (#20825023)
    is viruses. Virii is made up. Go look it up. Viri is man, there is no "virii"

  • Of course.... (Score:4, Funny)

    by TechForensics (944258) on Tuesday October 02 2007, @11:50AM (#20825029) Homepage Journal
    ... you don't have to worry if you run Linux!

  • the plural of virus is viruses (Score:4, Informative)

    by kcokane (253536) on Tuesday October 02 2007, @11:52AM (#20825061) Homepage
    in the text: ... with worms and virii....

    note: there is no Latin plural for the word
    virus (means slime, basically). the expected
    plural, viri, is the plural of vir (man). the
    plural of virus is viruses.

    • I'm surprised that this is not as well known as it is. Having had a feminist neighbor living next door for over five years now, one would think that it would be immediately obvious that the plural of slime would be men. Aren't the synonyms or something?

      • I'm surprised that this is not as well known as it is. ...

        That looks like one of the best self-contradicting sentences I've never seen.

  • There's a lot of conjecture here. (Score:3, Funny)

    by jackpot777 (1159971) on Tuesday October 02 2007, @11:56AM (#20825133)
    Isn't this all a bit "Schrodinger's Cat"? These virii are half-written, half not written, and we only get to know which one it is if we open the video clip of Anna Kournikova...

    Would the esteemed learning establishment care to debate if we will be living on the moon, wearing shiny suits, eating meal pills, flying around with our prsonal jet-packs? I for one want to know ...or at least have someone hypothesize if such a thing may be possible.

    Hmmmm.

  • Why should Flash have any kind of write access??? (Score:5, Insightful)

    by G4from128k (686170) on Tuesday October 02 2007, @12:02PM (#20825247)
    Why in the world should the Flash player have any kind of access/execution/write privileges on the browser's machine? I can understand that the player needs to be able to execute some form of code to create interactivity, but shouldn't this be so totally sandboxed that presents a minimal threat to the user or the OS.

    This just confirms my opinion that Flash is an evil cancer on the web designed to move control of the web experience from the person browsing to the Flash author (who maybe a botnet builder).
    • I'm pretty sure that Bill Gates could come much closer to being the botnet king if he wanted to.
    • It's security vulnerabilities in old versions of Flash Player that make them vulnerable to malicious files. Here's one of the more severe ones: http://secunia.com/advisories/26027 [secunia.com]. It doesn't matter if the file has no executable content when the reader has a buffer overflow that can be exploited with a malicious file. Strictly speaking, the exploit is executable machine code.

      The issue of executable or scriptable content in media files is something different. As other people pointed out, WMVs can have scrip
    • The Flash player runs in memory as a process, or at least within the memory space of a host process, and it is taking a stream of data from an outside source according to a protocol. There must be methods for handling that data and if those methods are not carefully constructed then it it may be possible for a malicious user to smash the stack [securityforest.com] by sending carefully crafted packets to the host running the flash session. Now, most modern operating systems, even including Windows after the 9.x branch was retire

    • Re:Why should Flash have any kind of write access? (Score:5, Informative)

      by gaspyy (514539) on Tuesday October 02 2007, @03:49PM (#20828705)

      This just confirms my opinion that Flash is an evil cancer on the web designed [...] blah blah blah

      This is just FUD - but obviously this is Slashdot so who cares about facts anyway?

      The truth is that the Flash player has actually a pretty draconian sandbox:
      1. A flash movie can not write to disk or execute any command. Period. It only has a "cookie" mechanism to store info on user's computer but the user can allow/deny the action and allocate a quota for that info. The cookie is saved in the user's Documents and Settings folder (and the Mac/Linux equivalent), e.g. "C:\Documents and Settings\user\Application Data\Macromedia\Flash Player\#SharedObjects\LQ93AHGQ\www.youtube.com" The flash app cannot control the location or the file name.
      2. A flash movie can't simultaneously have read access from the local file system and the Internet. What I mean is - either a flash movie loads a local file (text, xml, jpg, flv, etc) or it can communicate with a site (load URL, send variables with GET/POST, invoke a WS, etc) - but it cannot do both of them. A user has to go to Adobe website and specifically trust an application in order for that app to have more access.
      3. Flash movies can't read the clipboard.
      4. Access to microphone/webcam is disabled by default and must be enabled on a per-URL basis.

      Anyone who RTFA knows that it's not about exploits inside the video stream, it's about fake links.

      Now, I'm pretty sure I just wasted 10 minutes of my time trying to dispel some myths, because the average Slashdot user is too busy hating Flash and worshiping Steve Jobs. Mod me down, or better yet, just ignore this post and keep on living inside your bubble.

  • Re: Online Video May Conduct Viruses (Score:4, Funny)

    by bogie (31020) on Tuesday October 02 2007, @12:05PM (#20825295) Journal
    Was it a morally corrupt web site? Those are the worst kind.

  • Not new (Score:5, Informative)

    by packetmon (977047) on Tuesday October 02 2007, @12:20PM (#20825463) Homepage
    This attack vector isn't new however its spreading more and more as time progresses. What I find to be a worst attack vector are the ad servers such as Doubleclick, Akamai, etc.:

    Yahoo's Right Media had Trojans in banner ads
    Posted by Elinor Mills

    For several weeks starting in early August, visitors to MySpace, Photobucket, Bebo and other high-traffic Web sites were exposed to banner ads that contained Trojan horse software that could wreak havoc on a computer.

    Web security company ScanSafe tracked the malicious ads back to Yahoo's Right Media network and estimates that they ran several million times, according to The Washington Post's Security Fix news site. (source [news.com]

  • Online video may conduct Virusses ? Old news ! (Score:2, Informative)

    by Anonymous Coward
    Why is this posted as a supposedly novel discovery ?

    A previous post allready mentioned WMV format has an on-purpose function build-in that lets it "phone home" (and retrieve whatever code it likes) without as much as a peep to the user.

    The real issue here is not that some kind of "information" (movies, PDF's, etc) could harbour methods to retrieve (or even contain) the actual malicious code, but how the creators of those methods think that its a good idea to let their displaying-software "phone home" 1) whe
  • irony:

    Technical Writing Geek
    A report on threats via the Internet released by a Georgia Tech research center indicates online video may be a new avenue of attack. As the popularity of flash media continues to explode, hackers may be targeting embedded video players and more traditional video downloads with worms and virii. 'One worm discovered in November 2006 launches a corrupt Web site without prompting after a user opens a media file in a player. Another program silently installs spyware when a video fil

  • If for example a wmv file really contains and mpeg with some junk, is it enough to rename that whole file .mpeg or can you actually remove the junk. Something that does like a

    $ cat wrapped.wmv | grep -v "http://spawnsomecrap.com/crap.html" > clean.mpeg ..except in a windows utility (or command?!.)?..
  • I never understood how this is even possible. Like vulnerabilities in image formats or video formats. How does this work? The media player, or image viewer, should be reading the bits in the file and display it as an image, or as video. Why do these bytes of data get executed? Who writes an application which opens an image file, reads the bits from the file and then EXECUTES it ?!?!?

    I just don't get it. I'd love an explanation. Maybe it's like a website that takes user input and runs it as server side code.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.