Online Videos May Conduct Viruses

Technical Writing Geek writes "A report on threats via the Internet released by a Georgia Tech research center indicates online video may be a new avenue of attack. As the popularity of flash media continues to explode, hackers may be targeting embedded video players and more traditional video downloads with worms and virii. 'One worm discovered in November 2006 launches a corrupt Web site without prompting after a user opens a media file in a player. Another program silently installs spyware when a video file is opened. Attackers have also tried to spread fake video links via postings on YouTube ... Another soft spot involves social networking sites, blogs and wikis. These community-focused sites, which are driving the next generation of Web applications, are also becoming one of the juiciest targets for malicious hackers.'"

The word

[Anarke_Incarnate]

is viruses. Virii is made up. Go look it up. Viri is man, there is no "virii"

the plural of virus is viruses

[kcokane]

in the text: ... with worms and virii....

note: there is no Latin plural for the word
virus (means slime, basically). the expected
plural, viri, is the plural of vir (man). the
plural of virus is viruses.

Re:Anyone seen any code?

[grassy_knoll]

That's a redirection, not necessarily an infected FLV.

Plural of virus

[Spy der Mann]

http://en.wikipedia.org/wiki/Plural_of_virus [wikipedia.org]

I think that should clear it up. :)

Not new

[packetmon]

This attack vector isn't new however its spreading more and more as time progresses. What I find to be a worst attack vector are the ad servers such as Doubleclick, Akamai, etc.:

Yahoo's Right Media had Trojans in banner ads
Posted by Elinor Mills

For several weeks starting in early August, visitors to MySpace, Photobucket, Bebo and other high-traffic Web sites were exposed to banner ads that contained Trojan horse software that could wreak havoc on a computer.

Web security company ScanSafe tracked the malicious ads back to Yahoo's Right Media network and estimates that they ran several million times, according to The Washington Post's Security Fix news site. (source [news.com]

Online video may conduct Virusses ? Old news !

[Anonymous Coward]

Why is this posted as a supposedly novel discovery ?

A previous post allready mentioned WMV format has an on-purpose function build-in that lets it "phone home" (and retrieve whatever code it likes) without as much as a peep to the user.

The real issue here is not that some kind of "information" (movies, PDF's, etc) could harbour methods to retrieve (or even contain) the actual malicious code, but how the creators of those methods think that its a good idea to let their displaying-software "phone home" 1) whenever it likes 2) without notifying the user 3) without offering a way to disable it (it should be off by default if you ask me ...)

Re:They don't have to be

[mha]

Hi,

I would like to add my opinion this time. Some time ago I started a new idea: building *multimedia* learning content. Sounds easy enough, only that I had some more goals. Among them was to build a community-based platform - as in "OWNED by the community", not a "web 2.0" startup.

By the way, the current state is at http://letexa.com/ [letexa.com] - I'm giving the URL because you can see what I'm going to talk about next in real-life examples.

So, I tried with HTML/Javascript. I always knew I had to use Flash vor the Video and/or Audio in any case. See the Change-Blog of the site for how it went. I ended up with an all-Flash solution.

BREAK - for those asking me why I want video/audio and that this is a huge waste: I want MULTIMEDIA, as I already said... yes, I add closed captioning but I'm iin the "MM" business. I don't want to join a discussion "everything should be text", you can sell your TV and radio if you like (I don't have a TV at home at all) and go all-newspaper if you like. I *like* producing MM content.

So how can I produce content for worldwide delivery, that I can distribute not only on the web but as standalone software too? Produce Videos, like it's done so often? No way. I want to add interactivity (I admit to having just two interactive examples on my page, of the few that are there in the first place, and only one of them is actually *really* interactive content and not just "if you click here another video starts"), .avi .mp4 or whatever don't help at all. Also, other advantages of Flash:

- It scales. Not just the vector contents, the pixel-contents scales too! That sounds strange, but what I mean is this: You can add pictures (and videos) to Flash that have way more pixels than needed at the chosen resolution. This is NOT useless, because if the user resizes the viewer (which you as the author have to allow in the code and which youtube and co don't do) the additional pixels are used!

- When I create multimedia content and not a technical manual or a news article I like being able to position all content at exact places and sizes (and have them scale all together, see above). Flash does that. To do the same in HTML I need to add LOTS of Javascript and recalculate positions, add hidden divs for resizing detection, etc. HTML was made for Universities and tech. TEXT articles/content, and trying to create all kinds of stuff like user interfaces with it is just a huge horrible hack. The JS libraries that exist are fine (YUI is my choice, etxjs(.com) seems great too (originally it was a YUI extension) but is for web-based apps only - while YUI takes care of "normal" websites too). However, the complexity is enormous, and has anyone ever thought about where all those GIGA(!)-hertz are going? I used to have a 486DX33 and that machine was FAST! Do we really get THAT much more today for all the additional power of PCs, or isn't it true most power is needed to power the many many many code and library layers?

- So to come back to Flash, what I also like about it that the Player is pretty lean compared to what it does.

- the integration Javascript-Flash (Actionsccript) is VERY good (and Actionscript is ECMA script like Javascript, but they try to hide the prototypipcal inheritance and make it appear to be a "classical" inheritance language... oh well.

- What is BAD about Flash: Adobe is a BIG company and VERY bad at reacting to individual problems. Instead of bugfixes you get a completely new release 8and have to pay them again, big time - I had to purchase Creative Suites 1, 2 and 3 so far... but I must admit I'm quite happy with it overall)

So to finish my long but somewhat confused comment (my problem is I always start way too may thoughts and then get lost - don't tell me you didn't notice :-) ), for *my* problem of producing multimedia content I still cannot think of anything else but Flash! I obviously *have* to use "multimedia", and webbrowsers don't do

Correction : Everything conducts Viruses

[Repossessed]

+That link suggests that it's Windows Media Player, rather than WMV, that's the problem, due to embedded IEness. It also specifically mentions quicktime as an exploitable format. It also says there are exploits in second life (that's a new one on me actually).

So, list of places windows users will probably pick up nastyware now includes... actually, anybody know of something that *won't* lead to malware with windows?

Re:Why should Flash have any kind of write access?

[gaspyy]

This just confirms my opinion that Flash is an evil cancer on the web designed [...] blah blah blah

This is just FUD - but obviously this is Slashdot so who cares about facts anyway?

The truth is that the Flash player has actually a pretty draconian sandbox:
1. A flash movie can not write to disk or execute any command. Period. It only has a "cookie" mechanism to store info on user's computer but the user can allow/deny the action and allocate a quota for that info. The cookie is saved in the user's Documents and Settings folder (and the Mac/Linux equivalent), e.g. "C:\Documents and Settings\user\Application Data\Macromedia\Flash Player\#SharedObjects\LQ93AHGQ\www.youtube.com" The flash app cannot control the location or the file name.
2. A flash movie can't simultaneously have read access from the local file system and the Internet. What I mean is - either a flash movie loads a local file (text, xml, jpg, flv, etc) or it can communicate with a site (load URL, send variables with GET/POST, invoke a WS, etc) - but it cannot do both of them. A user has to go to Adobe website and specifically trust an application in order for that app to have more access.
3. Flash movies can't read the clipboard.
4. Access to microphone/webcam is disabled by default and must be enabled on a per-URL basis.

Anyone who RTFA knows that it's not about exploits inside the video stream, it's about fake links.

Now, I'm pretty sure I just wasted 10 minutes of my time trying to dispel some myths, because the average Slashdot user is too busy hating Flash and worshiping Steve Jobs. Mod me down, or better yet, just ignore this post and keep on living inside your bubble.