Crackers Tune In to Windows Media Player

jamshedji writes "Crackers are using the newest DRM technology in Microsoft's Windows Media Player to install spyware, adware, dialers and computer viruses on unsuspecting PC users."

It's like sun on your wedding day?

"It's pretty ingenious," said Patrick Hinojasa, chief technical officer at Panda Software. "To take an anti-piracy feature and use it to feed spyware is extremely ironic."

Not quite ingenious but certainly not ironic. Perhaps if they were loading copyrighted materials such as movies and music onto your machine while you were attempting to download the license for DRM *then* it would be ironic.

The sad thing is that 99% of Windows users are likely telling WMP to install these licenses automatically when they try to play a media file. It's the "popup addiction" at work. People can't stand popups and anything to get them out of the way for good is they way they want to go.

This is going to become yet another excuse for trusted computing and single codec repositories. "Look! You are being infected by those bad sites on the Internet! Want protection? Use trusted computing and you'll never have a problem again! Just sign here, here and here. Pay here and connect here. Ahh, isn't that better?"

Re:It's like sun on your wedding day?

All WMP versions that I've encountered through the current one have given a choice on whether to enable DRM at install. I've never tried installing with DRM enabled, so I don't know if it would request DRM on all files, or just makes sure to verify DRM on protected files, but with DRM turned off, I've not had a problem with playback of other files or portability of WMP-created media (e.g. CDs I've ripped to WMA. Yeah, I know, I should have used MP3 or Ogg, but CDex wasn't working for me at the time, and I was lazy; I've since rectified the transgressions).

I wonder how long until you're no longer given the choice to opt out of DRM at install, though.

True, but sad.

I agree with your trusted computing satement, if Microsoft does acknowlege this incident there will only be more problems. Microsoft has been doing this kind of thing for years, so I dont expect their announcements to suddenly be more honest. I'd be even more surprised if the mass media found the real story instead of propogating microsoft garbage speak. Microsoft has been loosing credibility for several years now, in the future I look for "non-trusted computing" to be EASIER, and more trusted. When consumers see a open market that meets these requirements (and it's already impressive), they'll seriously consider a new platform.

Trusted Computing Will Make It Worse

Trusted computing will make current spyware and worm problems a lot worse.

As soon as a bug is found in a trusted computing architecture, which WILL happen, things will get a whole lot worse for the average user. Spyware will be created which your hardware refuses to allow you to remove, even with a boot disk or safe mode. Your computer will refuse allow you to install anti-virus and spyware cleaning tools. The spyware will install a certificate with high trust levels for spyware vendors.

Even if no bug is found, companies like AOL have proven they're willing to sell out their customers by bundling adware with AIM without disclosure. This will likely create an initial hole which can be opened up much wider.

Issues like this are killing Windows. I learned my lesson a few years ago that almost no shareware or freeware can be trusted. This makes Windows a lot less useful and is one of the many reasons why I usually run linux on my desktop.

IMHO, trusted computing will only hurt Windows' usability by the average user.

Re:It's like sun on your wedding day?

Here is another quote:

"In this case, they're using technology meant to secure content. It just shows that the more bells and whistles you add to the technology, the more you open doors for the bad guys,"

To me this just proves that trusted computing is a bad deal. The more control you take away from the end user, the more control you give to the people who would hurt you.

Re:It's like sun on your wedding day?

It's not that it's being exploited by genius so much as it was implemented by arrogance. The very nature of DRM software is to conspire with a content provider to use Joe User's computer against him in a way that he cannot circumvent.

Any DRM implementation is more likely to be exploitable in ways such as this. DRM is more likely to be insecure from the user's standpoint because it's designed from the ground up with somebody else's security as the highest priority. And once the software has been exploited, it has the potential to be highly troublesome because the malicious code now has access to a system that was designed to prevent the owner of the computer from tampering with it. The more effective the DRM is, the more dangerous it is to the user.

Perhaps I'm being overly paranoid, but I find this to be quite alarming.

It's a bit like IE and activeX except..

this time.. we probably wont have the ability to turn it off.

This will become the new ActiveX.. I can see it already..

Simon.

Re:It's a bit like IE and activeX except..

No, in this case WMP asked to go download and install the codec needed to play the video file.
When the user clicks yes, then their system becomes infected.
So if you don't trust the video source, or set WMP to not download codec you will be safe

Re:It's a bit like IE and activeX except..

Actually, it has nothing to do with codecs. It has to do with acquiring a license to play a video file. And you can turn this off if you'd like in WMP. The problem is that most folks have it set to automatically acquire licenses by default.

Re:It's a bit like IE and activeX except..

"opens the web page specified by the file's creator. This page is intended to help a content providers promote its products"

In other words adware!

WMP IS ADWARE AND SPYWARE BY MS'S OWN DEFINITION AND DESIGN!

How much more obvious does it get?

One could argue for MS products opening their own Web page for some reason, but some other random company's Web page? I could see providing a URL maybe, but actually going to the site without your permission?

Tell me again MS doesn't want to control your machine!

Re:It's a bit like IE and activeX except..

You can turn the "feature" off. The spyware is installed when the player claims it needs a license. The settings for this are on the privacy tab.

Happy

I'm so happy that I've got a system that doesn't integrate every little bit into the OS! Too bad Mickeysoft still doesn't understand that more features don't make their system any better.

No logic

One has to wonder why an application whose primary purpose it is to just display data is such a huge vector for infection. What was Microsoft thinking when they made it possible for movies to automatically open URL's and install stuff? Perhaps someone can explain the logic to me.

Re:No logic

Microsoft was attempting to make their media viewing a bit easier by telling them the codec wasn't installed (rather than displaying their famous acid-trip screen saver) and that WMP could attempt to install it for them.

You are incorrect. This exploit has nothing to do with fetching codecs. It is a feature that will open a web page specified by the creator of the movie or song file, that is intended to allow the user to buy a license to use the media. Basically it is a "feature" whereby media player will see a movie, notice you don't have a DRM key for it, and open a web page so that you can buy said DRM key. Unfortunately, like usual MS was completely blinded by dollar signs and did not consider that arbitrary files could direct the user to any old web page, and since IE is full of holes, this makes it pitifully easy to use a media file as a trojan.

I have not looked at this exploit more than superficially so I am unsure if the media player will always open the page in IE, or if setting Firefox as your default browser will save you. I also do not know with what privilege level IE connects, at a guess I would think it is as you with the lowest security setting for that page, but it could be your default, or connect as "root." Someone also mentioned that there is a setting to disable this, but it does not seem to work.

It's partly the users' fault for

...expecting their computer to be reasonably secure by default, and not silently install programs from anyone who can lure you to a particular web page. Also for assuming that the computer equivalent of a stereo and VCR will not connect you to random places on the internet and randomly install programs. If Sony made it's consumer appliances like this, when you put a VCR tape in from your neighbor you would have to worry that it might make extra ads appear in the middle of your TV screen from that point on.

Re:No logic

Why do web pages need the ability to launch programs and install things? It's long been Microsoft's design philosophy to hook every one of their apps to the OS and to each other, and give each the ability to do as much as possible. The idea is that this makes productive computer use easier and more transparent.

And it does. Unfortunately, it also makes malicious computer use easier and more transparent. Microsoft has ignored that aspect to their design philosophy, and it's become the source of many highly-publicized security issues.

Re:No logic

If you RTFA, you'd understand that Windows Media Player attemps to connect to the Internet when a file is played that it doesn't have a valid license for.

In theory, if you download an MP3 with DRM enabled, Windows Media Player will search your computer for the license. If it doesn't find it, it will go to the URL specified in the MP3. This is part of the DRM spec.

"Hackers" are just taking advantage of this, creating fake MP3s/MOVs and making those URLs go to junk-infested sites.

In WMP's defense, it *does* ask you first if you want to go out and hit the site for the DRM license. And once you get there, if you're running SP2 then security is no different than any other mailious website you may visit.

SP2 should block the popups, and give you a much more informative warning if the site tries to push software onto your computer.

Crackers like...

Crackers like the RIAA/MPAA contractor Overpeer [slashdot.org]?

Hackers, not Crackers.

Really, the article says Hackers. Crackers break software.

I mean if you're going to rip the first line 'summary' from the article itself, why skimp on one word?

Re:Hackers, not Crackers.

Because as /.ers we know the difference, and these are most certainly crackers, not hackers.

What's with /. running months old news?

Ok I'll admit it. I did a search on Limewire for some "adult" type content. Every single movie I grabbed up tried to get me to install some piece of software in order to watch the movie. 1800fastsearch, etc. I was annoyed that the spyware companies had gotten their tentacles this deep in porn. Those bastards, is nothing sacred?

Re:What's with /. running months old news?

tentacles this deep in porn

Seems like a "5, Funny" joke is lurking in there somewhere...

Re:What's with /. running months old news?

Hey man, lay off the tentacle porn - some of us LIKE that!

No no no, all wrong

You people have it all WRONG, DRM was meant to Stand for Digital Rights Manipulation, it's actually a Microsoft feature.

Re:No no no, all wrong

I like the variant term Richard Stallman likes to promote: Digital Restrictions Management.

You know my solution.

Besides the obvious troubles of Windows, and of DRM, we now have the added issues of security? Well, at least I don't have to worry about it on my Linux desktop. Just on my Windows laptop. Really, I think that MS must try and leave these open so that they can sell subscriptions to their new AntiSpyware.

Re:You know my solution.

Thing is, this is one of those cases that hits Windows more because of the monoculture than directly due to the inherent security flaws or the DRM problem.

In general "advanced" formats will require downloading software. The fact that the "advance" here is DRM is almost immaterial, except perhaps for the fact that some people believe they're downloading a license rather than software. But Windows asks explicitly if you want to download and install the software. You get a warning, you have to say, "Yeah, I want that piece of malware." The message may not be clear enough, and since there are cases where you do want it you're asking a naive user to make a fairly sophisticated security judgment, but it is there, and the malware can't bypass it. It doesn't need to.

To my knowledge Linux doesn't have a good solution to that problem, either. If you need software to play that movie/music, it's up to you to verify that the software isn't malware. Linux users escape this problem largely because there aren't enough of them to make it worth the malware writer's effort (as well as the fact that Linux users tend to be better educated and would answer "Hell no!" to the question if asked).

What's needed here is a security sandbox. Download the codec but don't give it permission to do anything except take stuff from one place in memory and dump it to another, or access a limited direct-to-video API. No network access, no disk access. I'm not aware of any particular Linux security sandbox.

Microsoft does have its own, in its C#/CLR, though clearly that hasn't made it to the point of writing codecs yet. And it may not, since these are performance-intensive apps and virtual machines impose overhead. I've seen codecs written in Java, and they're tolerable but not what you'd choose.

Re:You know my solution.

On the other hand, so much of this could be avoided by at least not tying DRM into the lowest levels of the OS. Same issue as I have with MSIE. Comprimise Firefox, and you've comprimised an application. Comprimise MSIE, and you've comprimised Windows itself. Furthermore, since all lusers have admin privliges by default, any damage done by even an application can be severe. Hence, my reommendations. First, move the DRM layer out of the OS. Second, don't allow an admin to run the DRM-encrusted software.

Solution

Use the excellent - and free - VLC media player [videolan.org]

Surprise surprise...

Remember when media files used to be safe? When we only needed to worry about files with .exe and .zip and a few others containing viruses or malware? Even before the DRM stuff in Media Player, MS added the ability for video clips to launch web pages. Gee, great idea. Did they never think that people could have exploited that?

Is it really worth sacrificing the safety of media files so that video players could launch web pages and other code? Another example of Microsoft trying to add usability, whlile sacrificing security. There's no way they couldn't have known about this security flaw.

This is why I use Linux..

very little danger of getting infected in this way. And we don't have any DRM mechanisms to get in our way.

But really, Windows XP does provide a way to keep users from installing just any software, that is by having a seperate administrator user and do you surfing and P2P downloading using a "limited" user account.

I went to visit some relatives a couple of weeks ago and I found 250 dialers, spyware and malware programs on thier computer using Spybot. It was unbelievable!

Someone's got to say it

They aren't using Windows Media Player to install spyware. They are using WMP to get users to click on a link that takes them to a webpage where, presumably, the user's browser is compromised.

Give the proliferation of spyware *without* this new fishing technique, I don't understand the significance of this. People find spyware all by themselves, they don't need any help.

Plays for sure

so when Bill G was up hawking the MS 'plays for sure' market-speak, little did he suspect it was really infected for sure!

It's encouraging to know that the ...

comprehensive Microsoft security effort is continuing to provide new opportunities to developers/commercial interests to offer system enhancements, needed pharmaceuticals and privacy adjustments. It's so much better then on FOS or OS X, where such efforts are impeded.

Not only hackers!

Its not only hackers taking advantage of DRM vulnerabilities. This [virus.org] article at virus.org reports that the RIAA is also exploiting DRM!

"The contractor Overpeer who works solely for the MPAA and RIAA to polute Peer-to-Peer networks with corrupt and useless files has moved to a new low by using a loop hole within Windows Media DRM to launch popup adds and infect users PCs with Spyware, Viruses and Adware.

In what could be considered a quite blatent breach of computer crime laws the world over, Overpeer a company owned by Loudeye is making a lot of money seeding Peer-to-Peer networks with thousands of fake files. It's one of the entertainment industry's favourite, and most obnoxious, anti-p2p contractors.

The loophole in the Windows Media DRM process allows companies to create media files and link them to adware. When you normally download a protected Windows Media file, you also receive a license that lets you play it. If however Windows Media Player cannot find a valid license on your PC, it checks in with a remote system running Microsoft's Windows Media DRM Server.

You should rarely see that happen. Some files, however are set up to ask you for information before playing. They do this by displaying a URL in a dialog box labeled License Acquisition. Normally that dialog box is used to check for a user name or offer a chance to purchase the file that's being played. In a legitimate DRM-encrypted file the author may let you play it a few times, then bring up a window asking if you want to buy it.

Since the license dialog box is in essense an Internet Explorer window, it will display whatever is on the page it points to, in the cases that have been seen of this these trojaned Windows Media files, they all point to servers that load up unwanted ads, including windows that attempt install adware onto your PC surreptitiously, including adding items to your browser's Favorites list, attempting to change your home page and installing viral adware such as the 180search Assistant. "

Acording to the above article's date (December 31, 2004) Is it possible the RIAA inspired the hacker comunity?

Crackers?

Has anyone told Chris Rock that crackers are doing this?
He'll be pissed.

Winamp TV had this problem too

On the Beta Winamp TV stations, adult site operators quickly figured how to launch URLs on video streams. Needless to say, the support forums showed you how to turn off this feature about a day after the discovery.

Please, not every app in the known world needs to launch a freakin' web page, etc.

Incredible

How can it be possible for one company to make software with that many security flaws?!

Please clear this up for me...

What is the difference between DRM and spyware?

How could DRM work without inherently 'spying' on the user/victim?

When will Microsoft learn...

That no good deed goes unpunished?

WMP-out

If AOL would open the WinAmp source, after it was examined by a horde of cranky Slashdotters bent on porting it to Linux, it would be at least believed to be less buggy than WMP. It might whip WMP the way Firefox has whipped IE, Apache has whipped IIS, and all the other open source "utilities" are whipping unreliable MS software. Especially if the community could factor down only the essential WinAmp features, leaving the bloated full WinAmp available as #2, just like Mozilla.

heh

I thought this was going to be an article on a huge surge in Molly Hatchet and Lynyrd Skynyrd downloads

Damn...

And here I was hoping this was a great new way to spice up my saltines.

Better replacement for WMP

http://sourceforge.net/projects/guliverkli/ [sourceforge.net]

Windows media player like it should be. Low resource usage, plays dvds and any file you have the codecs for installed, without any network access at all. (Unless you're playing a stream or course)

Simple rule of thumb

This has kept my computer safe and my mind happy for the last twenty years. I don't plan to change it:

Don't buy products from Microsoft!

There is one exception: The Microsoft Optical Wheel Mouse is a great product. You can't fuck up a mouse, though.

Wait, Apple's round one-button mouse.

Now, that's a deal: Apple could learn from M$ how to design mice, while Steve explains to Bill what an Operating System is.

Glad to see DRM is protecting digital rights

When I first saw the story, I was afraid that hackers were somehow exploiting program flaws in media player that would give them unauthorised access, allowing them to install spyware.

Instead, it turns out that DRM is simply doing it's job - protecting the digital rights on content providers by punishing those people who attempt to gain access to unathorised media.

Here's my take, I'm pretty sure that I'll be safe wether I run linux or windows (I run both) since I am not ...wait for it... trying to leech other people's copyrighted material off of dodgy peer to peer networks!

If you engage in pirating, you deserve the cannonball to your vessel; I, for one, feel no pity.

Hastening The Death Of The PC

It occurs to me that this sort of thing is just going to hasten the death of the home PC as a media device. We've already seen the decline in the PC as a gaming platform relative to dedicated consoles in part due to ease of use issues. If I'm Jane user and just watching downloaded videos opens the door to hundreds of spyware apps and other nonsense, I'm going to stop using the PC for stuff like that if there's an easier to use alternative.

The next generation gaming consoles may be ready to become the easy to use box in the living room that is easy to use and never gets infected by viruses or spyware. If this happens, home PC sales will plummet! Couple these boxes with HDTV and high quality sound systems and it's game over for the PC. Slashdotters may be able to cope with the nonsense, but most people are going to take the easy way out, especially if the price of admission is low. As for me, I'd love to see a really good web browser on Sony's PSP, then I could do my mindless surfing in the living room on a reasonably good display.

I guess that explains that

I was in NYC on business at the end of last week. The owner of our company had me swing by his apartment while I was in town and he wanted me to setup a wireless network there - which I did.
As part of the process I was tasked with fixing the 3 XP laptops that were "not working" or "too slow".

Sure enough, I found that they all had spyware - but one had 52 viruses on it.

The best part was that his wife (it was her laptop) said to me "oh that is odd because my IT person from work JUST scanned that two days ago - so I hardly think that I got 52 viruses in two days."

I tried to be polite but essentially told her that she might want to look into getting a better IT person.

One of the viruses that she had kept spawning instances of the media player and I couldn't figure out why... now I see why I guess.

(technically some of the viruses were trojans/worms/spyware, so I guess I should just say "malware")

It could be much worse

Guys, it could be much worse. It's not like WMP is forcefully bundled into the world's most popular desktop OS or anything....

VIRUS ALERT!!!!

Warning!!!

Do NOT DOWNLOAD BRITNEYSPEARSNUDE.WMV!!! It is not really a video of her stripping. It is a virus!!!

BTW, HURRY! WAREZ LIST ENDS SOON!!!

This is good

The more WMA gets compromised the sooner we can dump it in favor of open standards.

Am I missing something?

It sounds like (after RTFA) all this does is direct a user to a website - supposedly to get a "license" to play the content.. and once on that website, spyware is downloaded.

So.. isn't this just a new way to get people to visit spyware websites.. which exploit flaws in IE? Meaning, there is no new flaw in WMP here?

As long as WMP uses your default browser to check for licenses (can someone confirm this?) I'm safe :-> (now, to download some more porn off eDonkey!)

Uneducated Users

Most people who use Windows are unaware of the fact that are running under an Administrator (root user) account where anything can be installed, copied or deleted. Including spware and viruses. To this day, I never understood why Windows computers don't come pre-configured to run as a non-root user with limited file, execution and registry privileges? If I remember correctly XP supports a feature called "run as" if a program needs to be run as root (ie. setup programs).

I say, "too bad if the user has to type passwords!" The world of single user, DOS type computing is over. Time to start educating the public about the need to type in some passwords every now and then. Today's Anti-Virus and other Anti-Malware applications just don't cut it anymore. Blocking malware at the IP/Port level is not enough as you can tell by the failures of SP2. Password protecting processes at the OS level and file access at the file system level is much more effective. This whole virus/adware problem could be substantially minimized if people would just be more damn educated and willing to sacrifice a little ease of use. If we can be inconvenienced to show ID at the bank and enter a pin number at the ATM I don't think it's so bad to enter a password on our home PCs either.

This automatic downloading has got to stop

It's all Microsoft's fault. They put backdoor IE invocations in everything. And now we're paying the price.

If you have to run Microsoft, one solution is to back off to Windows 2000. You run Windows 2000. Windows XP runs you. Many corporate installations refuse to go with XP for that reason.

It's not just Microsoft, either. Remember that DRM-protected CD that changed the firmware on Apple CD drives so the machine would never work again? (And remember Apple refusing to fix it under warranty?)

I'm not worried...

I can always use Microsoft AntiSpyware [slashdot.org] to fix the problem! Right?

Time to regulate Microsoft

Ridiculous! If ever there was anything that mandated nationalizing Microsoft and turning it into a regulated public utility, this is it - the straw on the camel's back! They seem incapable of doing anything that doesn't leave large holes that expose the security of every consumer to some dire threat! Every "improvement" is just another prelude to disaster. If this is the result of their focus on "security" - what do we have to look forward to is somebody comes in hung-over one day, and gets careless? Enough already!

But there's more of them argument - pfft!

It seems to me that this causes a leak in the argument that Microsoft apologists use when talking about viruses and spyware. You know the "Your OS would be just as insecure if you had 90% marketshare" argument.

Perhaps we can all agree that iTunes and the iPod currently enjoy a much, much larger share of the purchased digital music (and thus DRM) market than all of the Windows Media players combined. Yet as far as I know (and somebody may prove me wrong) but the DRM Apple uses hasn't been hijacked to carry malware. I'm not glorifying Apple, since they license Fairplay DRM from another company, but just pointing out that, market share being irrelevant, Microsoft seems rather incapable of writing any secure code whatsoever.

Ugh. Does everything that comes out of that behemoth have to be a complete piece of shit?

M$ is good for business

As an IT professional, I must commend M$ for another job well done. I have billed 6 hours this week (@$80/hr) fixing XP machines that were compromised via WMP. This is for 3 clients in a small town. What do you suppose this "feature" will cost consumers in the end.

Myself, I use linux on all of my desktops, OpenBSD on my servers and WinXP Tablet on my mobile "repair kit" laptop. The only thing I use the laptop for is backing up customer data before formating and reinstalling a fubared Windozer workstation.

While I promote open source software to my users, I would be out of work if Windows wasn't the standard.

You will be assimilated...

It's all part of the grand scheme

When will people realize that MS software and windows in particular are buggy with the purpose. And the purpose is to dominate the world.
MS needs to have its entire insalled base riddled with spyware, viruses, adware and all kinds of evil resource hogs to rally popular support for its next generation "solution" to the problem they created. The solution will gradually make them control the world. You know what I'm talking about, right? Palladium, DRM, La Grande (666).

Already Spyware

Isn't WMP already spyware? It seems to always want to be connecting to the Internet when I play local media on it.

Someone need to explain this

It seems that 99% of slashdotters didn't understand the article. The article author also has no idea about the subject. Even the "research note" is not perfectly clear.

This is not a security breach in Windows Media Player.

Here is what happens. A wma/wmv DRM protected file needs a license to be played. When WMP plays a file that does not have a license it will open a dialog with a web browser control inside and navigate to the "license store url" that was written inside the file. This feature is called "superdistribution" and it is present in other DRM enabled players as well.

That is all that Windows Media Player does. At most WMP can be acused of not displaying more information about why the dialog was opened. If even the slashdot crowd has problems understanding this, imagine the rest of the computer users.

Once the IE opens the web page it is no different than going to that url yourself in IE.

Tell me something new

In other news, Microsoft's products has been declared mega crap.

this is amazing..and a business opportunity

on the linked to research note reference,after first identifying one of the infected sites/downloads, he states

"On a fresh test computer, I pressed Yes once to allow the installation. My computer quickly became contaminated with the most spyware programs I have ever received in a single sitting, including at least the following 31 programs: 180solutions, Addictive Technologies, AdMilli, BargainBuddy, begin2search, BookedSpace, BullsEye, CoolWebSearch, DealHelper, DyFuca, EliteBar, Elitum, Ezula, Favoriteman, HotSearchBar, I-Lookup, Instafin, Internet Optimizer, ISTbar, Megasearch, PowerScan, ShopAtHome Select, SearchRelevancy, SideFind, TargetSavers, TrafficHog, TV Media, WebRebates, WindUpdates, Winpup32, and VX2 (DirectRevenue). (Most product names are as detected by Lavasoft Ad-Aware.) All told, the infection added 58 folders, 786 files, and an incredible 11,915 registry entries to my test computer. Not one of these programs had showed me any license agreement, nor had I consented to their installation on my computer."

$^&*((()! Frikking amazing!

man, fatcity for all the whitebox windows repair guys out there. Guaranteed job security! Hey, you California guys! Take advantage of the new antispyware laws that went into effect, a lot of loot there possibly if you follow through with complaints perhaps!

uuhmm

i think we all know that 'crackers' is a derogatory term by now

Even more reasons...

Even more reasons not to go legit for downloading music from the internet.

Jason Spence: The black hat community is drooling

I've had the following in my signature file rotation for some time. Looks as if it's starting to be fulfilled:

The black hat community is drooling over the possibility of a secure execution environment that would allow applications to run in a secure area which cannot be attached to via debuggers.

- Jason Spence, on Palladium aka NGCSB aka "Trusted Computing" [zgp.org]

Group policy to block 'smart' family.

For those who prefer group policy over screwing with the wmp settings (good for hiding settings from family) and can't find it: it's in Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Digital Rights Management. My family is smart enough to check options, but not smart enough for gpedit.msc. muahahaha.

Licenses?

The trouble begins when software requires outside assistance. Whats with all this outside assistance anyways? Since when do we all of a sudden need a license to listen to stuff. I never needed a license to make a copy of music on the radio or record a TV show on my VCR.

Don't you think companies are taking this encryption and licensing crap too far? Perhaps Notepad or Calc should be licensed too. Helk, I may have the need to add some numbers and type some text and God only knows who has the patents on the letter 'H' and the number 7!!

Stereotypes (sic)

Is it just me, or did this title make anyone else think of a bunch of rednecks sitting around on a front porch, drinking beer, talking sports, cars, and coon dawgs, with a 196s clock radio tossed off the end of the porch and a computer sitting on a wire spool with car speakers jury rigged to it, and Windows MediaPlayer running on a 13" monitor in 640x480 mode?

[Run-on sentences a specialty]

Re:Unsuspecting???

For those who still don't suspect, you might try Firefox.

What does Firefox have to do with ending Spyware via WMP? Absolutely nothing. Last time I checked Firefox opened WMP on Windows machines when you attempted to play a media file.

Hmm.

Now maybe if you had suggested some little known media player that didn't automatically install codecs after you clicked "don't ask me again, just install" then maybe your post would have been worth something.

At least RTFA.

Re:This is news?

Download porn from kazaa lately?

Many of us stopped downloading any .wmv files _years_ ago, because they frequently require a licence to play which is a PITA for offline viewing.

...so, when did Firefox become...

...a media player? It's a flaw in Windows Media Player, not (unusual as it is) Internet Explorer.

So, in other words - use VideoLAN :)

Re:Unsuspecting???

Firefox is a browser not a media player.

If you want a decent open source media player, choose VLC [videolan.org]. It works great on Win32, Linux & OS X. Works well supporting CDs, DVDs, AVI, DiVX, MP3, Ogg and just about every other media format known to man - except protected WMA.

So if the exploit relies on dangling a "carrot" in the shape of some free pr0n if you download some licence into WMP, VLC won't protect you from yourself and doesn't offer comparable functionality.

Re:Unsuspecting???

However, officials at AOL and WeatherBug did not take too kindly to the classification. "The vast majority of anti-spyware providers do not consider WeatherBug to be spyware, including Aluria, our own anti-spyware provider," said AOL spokesman Andrew Weinstein.

Is this guy serious ? Because the company's own software doesn't consider its other software bad, this is supposed to make us feel better ?

Re:Unsuspecting???

However, officials at AOL and WeatherBug did not take too kindly to the classification. "The vast majority of anti-spyware providers do not consider WeatherBug to be spyware, including Aluria, our own anti-spyware provider," said AOL spokesman Andrew Weinstein.

I love that part of the eweek article in the grandparents post. God forbid AOL's own anti-spyware division peg it's own spyware as spyware.

Genius. Anyone know if Webroots SpySweeper removes WeatherBug? or AdAware? I'd like to know what REAL spy removal ap's think.

This is why I would only use MicroCraps AntiSpy/Virus crap with other more traditional methods like AdAware and SpySweeper. Atleast AdAware stays true to their roots without kissing other companies asses. The inhumanity that most people won't ever know about the shit that goes behind the scenes.

Re:Unsuspecting???

I use FireFox, but the problem here is Media Player that I sure is using IE components. I've noticed this problem too and it's gotten to where I just don't download WMV files. Long live MP3 and MPEG! I haven't found a good WMP open-source replacement yet; otherwise, I would get rid of it like I did MS Office (replaced with OpenOffice.org) and IE (replaced with FireFox).

Re:I know this is a very pro linux forum but

Yes, holes are announced for Open Source OSs and Applications on a somewhat (but nowhere near just as) similar basis. But then again, consider this:

These holes are often patched within a short time frame in the Open Source world. Most times, a patch is released not long after the bug is discovered, and more often than not, some end users will write their own patches, resulting in not only timely but optional fixes.

Now, M$ took how long to release SP2? And it did what? Sure, fixed a few holes, but a Windows XP Home Edition computer is still as easy a target as ever thanks to all sorts of new and wonderful exploits, and some that have been known of for months, if not a year or two. And when are they going to fix these holes?

Well, a new major release for IE has been pushed back a few years, and Longhorn (aka LongWait, LongOff, TakingTooLonghorn) is quite a ways off itself. Microsoft has said that it won't release another patch until Longhorn is released.

Which means XP users are fucked until Microsoft decides to descend from the heavens with their miraculous new piece of ill-planned garbage that promises to make it all better.

Meanwhile, us Linux users wait maybe a few months for a good patch, which more often than not works, and continue about our business in a much safer environment.

Re:My issues with Windows 2000

You claim to be a Windows user and you haven't already been aquainted with the crash-curse-reformat-reinstall drill? I think you made your whole story up.

Re:I know this is a very pro linux forum but

Well, you see, the security hole in any particular piece of Free Software only affects "some fat slob in a basement somewhere." Even a single security hole in a Microsoft product affects almost everyone.

Let alone that Microsoft products have more, worse flaws than most individual Free programs...

Comparing a hole in Free software with one in Microsoft software is like comparing a light rain to the [Biblical] Flood.

Re:I know this is a very pro linux forum but

There are two key differences. One: OSS is much less used, therefore an exploit of an OSS hole will do much less damage, therefore those exploits are much less common. Two: OSS developers (in general, not all of them) know that one reason a lot of people use their software is that it is supposed to be more secure, therefore they put an emphasis on keeping it secure (in order to keep people using their software), therefore they patch those holes in very short order.

M$ on the other hand... One: Very widely used, therefore an exploit will go far and do a lot, therefore those exploits are written. Two: M$ users as a general rule (once again not all of them) are not as security conscious as OSS users, and therefore 1)they dont bother with the patches, 2)M$ doesnt bother making the patches in a timely manner.

Thus, M$ products attract more exploits, and the holes are (in general) open for much longer after discovery, leaving more time for even lazy hackers to write exploits.

Re:My issues with Windows 2000

Spy Sweeper [webroot.com] Try this program in addition to SpyBot & AdAware. Spyware is one area where you need to seemingly use more and more programs to keep your system clean. Its one of the few known good pay-for-AntiSpyware products. Maybe even try Microsofts spyware? It surprises me how much stuff you find with each additional product you use. Crazy.

Since you seem to know what's going on I'm also going to suggest HiJackThis! [spychecker.com] Use it to find exactly what programs are opening on boot, and tons more information. If this is too much info for you just search google for HiJackThis Log Forums. Proffesional Nerds volunteer to help talk people thru the logs. Use it carefully as it is a powerfull tool.

I'm assuming you have some flavor of anti-virus and firewall.

If all else fails, maybe you need to format and upgrade to XP? Not sure if that's an option for ya tho.

Re:I know this is a very pro linux forum but

Actually MSFT is the probelm. Forget being pro-linux(i am not currently running it). MSFT doesn't know security. It doesn't know how to design security. MSFT first builds features and then tries to figure a way to secure them. Your supposed to work the other way around.

Also Why does WMP default open IE eve if your default web browser is something else?

MSFT programs that were designed wrong to begin with

IE, WMP, Outlook, Active X, Windows Scripting, MS word macros, MS excel Macros(yes they are close).

The fact is MSFT has designed lot's of software and duplicated functionality first, then thought about if what they were doing could cause a probelm.

No OS or software is perfect, but MSFT puts stupid obvious holes in their software and dismisses those who complain. there is no reason why Active x should be designed to take advantge of the entire system. How about Macro's? IE, WMP, Outlook are basically ONE program. That is how tightly they are tied together. Is there a reason why?

Re:My issues with Windows 2000

Which is why once a year or so I do a scheduled complete re install. everything gets backed up and then I boot from a floppy and type my all time favorite command for cleaning a windows computer.

format c: /s

it takes a couple of days but hey it's all good.

Re:My issues with Windows 2000

You have to run spybot and adaware in safe mode. if you dont do that it misses things.