Forgot your password?
typodupeerror
Security Media Music

Worm Transcodes MP3s To Infect PCs 385

Posted by kdawson
from the just-don't-click dept.
snydeq writes "Kaspersky Labs has discovered malware that inserts links to malicious Web pages within ASF media files, posing a danger to Windows users who download music files from P2P networks. Infected files launch IE and load a page that asks the user to download a codec. The download, a Trojan horse, installs a proxy program to route other traffic through the PC. The malware also has worm-like qualities, according to Secure Computing. It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container, and adds links to further copies of the malware, all without modifying the .MP3 extension."
This discussion has been archived. No new comments can be posted.

Worm Transcodes MP3s To Infect PCs

Comments Filter:
  • by brunascle (994197) * on Friday July 18, 2008 @09:37AM (#24242155)

    It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container

    Wow, that's evil, even for malware authors.

    • by Z00L00K (682162) on Friday July 18, 2008 @09:40AM (#24242217) Homepage
      Maybe it's the RIAA that wants us to get rid of all our MP3:s downloaded from various sources?
      • by flyneye (84093) on Friday July 18, 2008 @10:16AM (#24242831) Homepage

        I want the RIAA to be DEEPLY investigated,prosecuted with a fair trial and a decent hangin'.
                  The music industry is terminal.It's lashing out in its dying breath.
                  Just run your antivirus over your downloads before playing.
                  Let's just go ahead and keep killing the industry so musicians can have a level playing field and we can do away with the corruption and misdirection to mediocre talent it provides.

        • Re: (Score:3, Insightful)

          by DickBreath (207180)
          >Just run your antivirus over your downloads before playing.

          Do you really believe this would be effective?

          Wouldn't it be more important to run your antivirus on your codecs before installing?
    • by morgan_greywolf (835522) * on Friday July 18, 2008 @09:48AM (#24242335) Homepage Journal

      Wow, that's evil, even for malware authors.

      That's nothing. I heard the next version will automatically go out the Web, sign up for an e-Trade account, and then proceed to buy stocks like GOOG, AAPL, RHAT, etc., and automatically sell them short.

      • Re: (Score:3, Interesting)

        by mr_mischief (456295)

        Well, that trojan has a bug. When you sell short, you sell a stock then buy it. Yes, really. [investorwords.com]

        That's what "short" means -- you don't have all the shares you need to cover the sale, so you're short. A "naked short" means you also don't have the funds set aside to buy and deliver the shares you sold or enough shares of the company in your portfolio to make up the difference.

        The idea is that you sell at or just below the current price, expecting the stock to tank. Then you buy the shares before the agreed-upon t

    • by oahazmatt (868057) on Friday July 18, 2008 @09:52AM (#24242407) Journal

      It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container

      Wow, that's evil, even for malware authors.

      That's nothing. You should see the fix. Your anti-virus program will update its definitions, and if it identifies any of these files prior to download, it makes them appear in a Real Audio format so your never tempted to download them to begin with.

    • by hyperz69 (1226464) on Friday July 18, 2008 @09:54AM (#24242435)
      No, Evil is if it transcodes them to Real Media. Though I don't even think Satan himself could do that to anyone!
    • by millwall (622730) *
      Well, Kapersky labs tells us that the MP3 files are in fact turned into WMA format and not ASF format [kaspersky.com]:

      The worm, which was named Worm.Win32.GetCodec.a, converts mp3 files to the Windows Media Audio (WMA) format (without changing the .mp3 extension)

      • by omeomi (675045)
        Well, Kapersky labs tells us that the MP3 files are in fact turned into WMA format and not ASF format

        The summary already says that: "It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container"
      • Re:wow, that's evil (Score:4, Informative)

        by Per Wigren (5315) on Friday July 18, 2008 @10:07AM (#24242671) Homepage

        WMA, WMV and ASF are the very same container format. The only difference is the filename extension.

        • Re:wow, that's evil (Score:5, Informative)

          by clone53421 (1310749) on Friday July 18, 2008 @10:28AM (#24243053) Journal

          ASF is the container, WMA is the codec.

          WMA can be used to refer to the container [wikipedia.org], but it's actually an ASF container with a WMA track inside.

          That's confusing, and basically the file extension refers to the codec, not the container. The WMA or WMV files you download are actually ASF files. It's about as logical as having the DIVX extension for AVIs with DIVX encoding, but hey... who's going to try to change it?

          • Re: (Score:3, Funny)

            by Anonymous Coward

            but hey... who's going to try to change it?

            I will, in 10 years after I become batman.

          • ASF=WMA=WMV (Score:3, Informative)

            by benwaggoner (513209)

            Yes, same file format. It was originally called just .asf, but changed by default in the late 90's, IIRC, to different extensions for video and audio.

            This enabled different icons for video and audio files, and easily filter between them so you didn't accidentally try to sync video to an audio-only player.

            This is pretty standard practice. .m4a, for example, is a MPEG-4 file with just audio. .f4v is is a MPEG-4 file known to be compatible with Flash.

        • Re: (Score:3, Informative)

          by afidel (530433)
          Technically WMA and WMV are a family of codecs and they use the ASF container format for metadata and DRM.
    • by colmore (56499)

      It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container

      Dammit. That sounds more interesting than any programming job I've gotten in the last 5 years.

    • It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container

      Wow, that's evil, even for malware authors.

      I think the summary missed a paragraph.

      It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container and holds them hostage for One Million Dollars!

    • Re: (Score:3, Informative)

      by sm62704 (957197)

      I hate to say "I told you so" but... Ok, I don't hate telling you that, but I hate that I was right. Damn it, I'm not a security professional, why could I see this coming but the professionals couldn't?

      I've been warning people about using WMA files and Windows Media Player for years, the first I said of it was back when I had my old Quake site, the Springfield Fragfest. A security researcher who played Quake II saw the post, realised that I was right, and we had a rather scary email conversation. I've been

  • Ouch!

    Next thing you know the infected MP3 files will be loaded onto and playing on cell phones everywhere and we'll be running from crazied people who are addicted to You Light Up My Life....
  • by Anonymous Coward on Friday July 18, 2008 @09:37AM (#24242167)

    If you'd just used OGG, this never would have happened! ;-)

    • by Z00L00K (682162) on Friday July 18, 2008 @09:48AM (#24242337) Homepage
      The basic format wouldn't make any difference. The problem is with formats that are incorporating extra features and functionality. If it's MP3 or OGG that's encapsulated is really not an issue.

      We are moving into darker and darker times when it comes to malware. It seems to me that they are trying every evil alternative to make us and our computers to zombies.

      How to remember the good old days when we could get the "Your computer is now stoned" or an east german ambulance with sound passing over the screen. Pretty annoying but relatively harmless.

      • Re: (Score:2, Insightful)

        by paradxum (67051)

        Yes, I too remember the days when there was little if any monetary gain to be had from writing a virus or hacking in general.

        But those days are gone, there is money to be made... now that it pays to hack, the onslaught will only get worse.

      • I think GP meant to say "OGG/Theora", and not just OGG.

  • Gentlemen, (Score:5, Funny)

    by Anonymous Coward on Friday July 18, 2008 @09:37AM (#24242171)

    I must applaud the RIAA on this occasion. I may have mocked their efforts in the past, but this is truly an impressive piece of work, worthy to be called a hack.

  • Nice (Score:5, Insightful)

    by Anonymous Coward on Friday July 18, 2008 @09:38AM (#24242177)

    Way to go Microsoft!

    Is there anything these morons can't fuck up?

    • Re:Nice (Score:5, Informative)

      by pxc (938367) on Friday July 18, 2008 @09:43AM (#24242285)

      For those of you who think this is just a troll, or are just unfamiliar with ASF:

      Advanced Systems Format is a Microsoft-defined container format for audio and video streams that can also hold arbitrary content such as images or links to Web resources.

      If a user plays an infected music file, it will launch Internet Explorer and load a malicious Web page which asks the user to download a codec, a well-known trick to get someone to download malware.

      It's like the ActiveX of multimedia wrapper files. A security nightmare? You bet. Does it still depend on user stupidity? Well, yes.

      • Re:Nice (Score:4, Interesting)

        by UnknowingFool (672806) on Friday July 18, 2008 @09:52AM (#24242393)
        That explains a lot. A few years ago before youtube was popular, a friend linked a website with a funny clip and as soon as the clip opened, it launched IE. Now I had my firewall set to prompt on IE so nothing happened unless I allowed it. I wondered how it was able to do that. Maybe I'm too set in my old school thinking but I think a media file should not have arbitrary content. Or at least limit what could be used.
        • by KlaymenDK (713149)

          I think it's fine that a file has arbitrary content.

          That the data is able to surreptitiously start network connections? Not so much. At least, the application should have the decency to inform the user before acting on its own.

          This is a good example of why don't at all mind not-so-integrated applications, as it means I'm less exposed to this kind of "multimedia experience".

      • Re:Nice (Score:4, Interesting)

        by hairyfeet (841228) <.bassbeast1968. .at. .gmail.com.> on Friday July 18, 2008 @09:56AM (#24242471) Journal
        This may be a new variation,but believe me,this is a VERY old problem. I have worked in PC repair more years than I can count and I don't know how many times I have gone into a clueless users's "MP3" folder to back up before a wipe only to find after turning on "show file extensions" MP3.EXE,MP3.ASF,MP3.WMA,etc. If someone downloads strictly by name and opens anything they get without doing any kind of virus checks they ARE going to get bit. What we need is the guy from the actors studio in the Geico commercials to go "Stupid users behaving stupidly.....Brilliant!". But as always this is my 02c,YMMV. Oh,and the worst infected were always either on Kazaa,Limewire,or Bearshare. Don't know why,but those three always attracted the really clueless.
      • Re: (Score:2, Insightful)

        by Trigun (685027)

        If there is one thing that is guaranteed in life, it is stupidity. Count on that, and remove the other vectors.
         

      • Re: (Score:2, Insightful)

        by geogob (569250)
        This is really clever. That way of using the file container to get the user to download false codecs.

        I wonder if it could work with other wrappers, like AVI, Quicktime, etc. Maybe not in their original state, but with slight modifications that could fool the player.

        I wasn't aware of all the capabilities of the ASF wrapper, but that sure was a ticking time bomb.
  • Nothing New... (Score:4, Informative)

    by mariofreak (1328373) on Friday July 18, 2008 @09:41AM (#24242239)
    I don't think this is anything new... I've been caught out by it before. There was a site that claimed to provide mp3 downloads, made you install a codec that just redirected all your internet requests to their proxy. I wiped the system after that.
    • Re:Nothing New... (Score:5, Insightful)

      by dreamchaser (49529) on Friday July 18, 2008 @09:48AM (#24242345) Homepage Journal

      You should turn in your geek card for falling for that one! Any site you don't 100% trust that asks you to install a codec for a file format you can play already screams 'malware' in a loud shrill voice.

      • by omeomi (675045)
        Any site you don't 100% trust that asks you to install a codec for a file format you can play already screams 'malware' in a loud shrill voice.

        That's good advice, but just because you can play the file format doesn't mean you have the right codec...
        • Re: (Score:3, Informative)

          by Obfuscant (592200)
          That's good advice, but just because you can play the file format doesn't mean you have the right codec...

          It means you have A codec that works, and all the player cares is that you have A codec that claims to work. If you can play the file format, you have both a working codec and a codec that the player knows about, so the player isn't going to tell you that you need to download another one.

          Any WEBSITE that tells you that you need to download a codec when you already have one for that format is screamin

          • Re:Nothing New... (Score:5, Informative)

            by omeomi (675045) on Friday July 18, 2008 @10:52AM (#24243445) Homepage
            It means you have A codec that works, and all the player cares is that you have A codec that claims to work. If you can play the file format, you have both a working codec and a codec that the player knows about, so the player isn't going to tell you that you need to download another one.

            That's actually not true. It's less of an issue with audio file formats, but video file formats can contain video compressed with any number of codecs, and you need the correct codec to play them. For instance, if I can play raw .avi files, but don't have the DivX codec, I can't play DivX encoded .avi files at all. I need the DivX codec.

            Any WEBSITE that tells you that you need to download a codec when you already have one for that format is screaming MALWARE,

            You are correct that many malware websites use fake codecs to install their malware, but it's just not true that any codec will work for any given file format. Just because you can open the file doesn't mean you have the right codec to view the content. It has nothing to do with the "fastest" or "best" codec. If you don't have the right codec, the video won't play back at all.
      • I thought that was "Exterminate!" that it shouted. You know, those pepper pot guys...Joking aside, I did my share of stupid stuff long long ago. I remember installing snood because some one said it was the best game ever, and then needing to purge my system to get rid of gator and all of it's related slop. Yes, it was extremely stupid and I should have known better (I think I was 17 at the time) but I never made that mistake again. Quite frankly I think you should not get your Geek Card until after you
  • by UnknowingFool (672806) on Friday July 18, 2008 @09:44AM (#24242287)
    Can anyone comment about the possible risk to non Windows machines? Well it appears that IE is affected as well as the ASF format. The Trojans itself appears to be Windows only. Does anyone know if FF or other browsers can be used? Also I don't know much about the ASF container but if you run it in another player like iTunes will it still activate?
    • Also I don't know much about the ASF container but if you run it in another player like iTunes will it still activate?

      The ASF container is patented in the United States, home of Microsoft Corporation, Apple Inc., and Slashdot. Microsoft wants to be the only vendor of ASF tools; to this end, it has cease-and-desisted VirtualDub's author from including ASF support. And Microsoft's ASF parser is, predictably, the exploitable one.

  • Data vs Program (Score:5, Insightful)

    by mlwmohawk (801821) on Friday July 18, 2008 @09:46AM (#24242311)

    Microsoft has a SERIOUS design pathology. They too often confused "data" with "program." Every G.D. thing in Windows can, in some way, initiate an action. This is a problem.

    A "music" file should be data. E-mail should be DATA! This is absolutely crazy. Making everything capable of being interpreted as programmatic content is at best a security flaw.

    • Re: (Score:2, Funny)

      by Anonymous Coward

      You mean just have it read X bytes of data and stop!? But how would they have supercyberhyperwebbrowsing? I want gimmicks not reliability.

    • Re: (Score:2, Informative)

      by Zoltair (721973)
      I am not so sure it is a MS issue, they are developing "by popular demand". Computer users (yourself included, me too!) have demanded more automation, they want less user interaction, thus MS and everybody else will develop for these wants. I remember when email was just that data!, had to uuencode/uudecode anything binary, Gopher was the the WWW back then, automation has removed that need, but it has also left us all open to attack. If it were not for our need and desires for this automation, we would all
      • Re: (Score:3, Insightful)

        by mlwmohawk (801821)

        Computer users (yourself included, me too!) have demanded more automation,

        Speak for yourself. I don't want "automation" and most of my family and friends get confused by it, "Hey, why is it doing that?" is the typical response.

        they want less user interaction, thus MS and everybody else will develop for these wants.

        You are confusing "wanting it to work" and "automation." Clicking, or double clicking, on an icon in a window and having the correct player pop up and play the file correctly is what people want.

      • by 1u3hr (530656)
        I am not so sure it is a MS issue, they are developing "by popular demand". Computer users (yourself included, me too!) have demanded more automation

        Perhaps you can substantiate how this "popular demand" was determined? By who? When? Where?

        Application writers, advertisers and other assholes have wanted to make it easier, and preferably, automatic, for users to install their software. I don't know of any surveys of users on this subject.

    • Re: (Score:2, Informative)

      by geogob (569250)
      I don't agree with your evaluation. As I understands it, the asf contains a download link for the codec. The player Program for the file (most likely windows media player components) initiate the "please download this missing codec" action using the information within the ASF container (link to the trojan/worm).

      This is the problem right here: Using corruptible information for a system-sensitive operation. WMP should only initiate such a download from a secure and authenticated source on the internet or us
    • by Applekid (993327)

      A "music" file should be data. E-mail should be DATA! This is absolutely crazy. Making everything capable of being interpreted as programmatic content is at best a security flaw.

      I'm not going to dispute that, I fully agree. In a sense, though, the infected "mp3" file is still just data... it's the codec library that's malicious. It's no different than files wrapped in that damned Zango codec that's basically just malware on top of an existing mpeg-4 decoder.

      The splitting of codec versus player I think was a great development that's been pretty much made obsolete by huge storage space, GHz range processors, and codec packs like K-Lite and DefilerPak. My personal (and admittedly anti

    • It is not all Microsoft's fault. The mixing of "data" and "program" goes much deeper than just Windows because ever since the Intel 8080 modern commodity processors, with a few exceptions, have made no clear distinction between data and programmatic instructions when it comes to loading registers, shifting data, jumping to addresses, etc from a common memory address space. This original design decision lies at the heart of many modern computer problems and hacks (i.e. smashing the stack). So although Micros
  • What player? (Score:5, Interesting)

    by Blice (1208832) <Lifes@Alrig.ht> on Friday July 18, 2008 @09:48AM (#24242351)
    TFA doesn't say what media player is vulnerable to this...

    I have a feeling this exploit doesn't work in VLC.

    A few days ago I played a movie in VLC on a Windows machine and half way through the VLC error log opened and had some interesting things in it. It was trying to place some files into some directories, and then lastly was trying to open a website.

    So it wasn't able to do those things, but I can't help shake the feeling that if I had played it in Windows Media Player it would have done some damage. Though it could have also been an exploit for a specific player like Realtime, Xvid, etc..

    Disclaimer: I'm not associated with VLC, although I do really like it.
    • Re: (Score:3, Insightful)

      by X0563511 (793323)

      My question is how the hell that works? Why is it even possible to do that!?

      Data comes in, gets split into an audio stream and a video stream. You look at the magical tags and figure out which decoder to fire up. Feed compressed data into the decoder, get decompressed data out. Pass the video data to the display pipeline, and the audio data to the audio pipeline.

      There should be no way to execute anything from those pipelines.

      • Re: (Score:3, Informative)

        by afidel (530433)
        Open webpage to display cover art, link to the bands tour page, etc. The problem is that it uses IE to open the page no matter what you have your default browser set to and we all know how secure IE is. It can also have an embedded link to a download for a new codec, if you don't have the codec then it will ask you if you want to install it. In this case the codec is a trojan.
    • by Joce640k (829181) on Friday July 18, 2008 @10:13AM (#24242787) Homepage

      So ... I think we can deduce which players are vulnerable to this.

  • by Gothmolly (148874) on Friday July 18, 2008 @09:54AM (#24242433)

    This is why you separate the executable code from the data.

    • by zappepcs (820751)

      I'm glad you were modded up. Running everything in a sandbox that disappears on reboot, and other methods to keep real data away from what your doing online is the what will make it safe(r). In the case of simply separating user data and system data, such malware still has a chance to truly fsck with you. The need is to keep online malware 'away' from your user data AND system data. To do that, you need to do the equivalent of putting on rubber gloves, mask, protective goggles and going over to your neighbo

  • Hmmm, it sounds like this kind of worm really benefits the RIAA. It works like this: If all your mp3 files are encoded from your own CDs for legitimate purposes, then nothing will happen to you. But if you download a single song, or if you copy a single song from a friend, then BOOM! All of your music becomes totally jacked up. It seems a pretty sophisticated worm/virus concept and the transcoding of mp3s is kind of like an additional "fsck you" from the RIAA.

  • hmm... (Score:4, Funny)

    by Taibhsear (1286214) on Friday July 18, 2008 @09:56AM (#24242481)

    Good thing I only download FLAC and transcode it myself to mp3... I mean, I buy cds straight from the RIAA for $50 a pop so I can bypass those greedy artists... yeah, that's the ticket...

  • by Doc Ruby (173196) on Friday July 18, 2008 @09:57AM (#24242495) Homepage Journal

    The buggy format is not MP3. The MP3 files are perfectly safe.

    This worm transcodes them into ASF files. The ASF files are the threat. The ASF files pretend to be safe MP3s, but they include links that Windows automatically opens. MP3 files don't do that.

    Of course, it's really Windows that's buggy (duh). Windows allows the worm to enter and run. Windows lets the unsafe ASF files appear to the operator to be safe MP3. Windows opens the ASF links to the bad sites. Windows then runs whatever the bad sites deliver to the browser (which the user could have just clicked to from another page, without the MP3/ASF worm at all, and just blown their system by Web surfing).

    But of course, we can't say that Windows and ASF and IE are the security monsters. We have to blame MP3. Even though this exploit requires converting the file into something that's not MP3 before it can get started attacking you.

    • by Tim C (15259)

      Windows lets the unsafe ASF files appear to the operator to be safe MP3.

      The last time I opened a file in Windows Media Player that had an incorrect extension it warned me of the fact, giving me the option of not playing it.

      But of course, we can't say that Windows and ASF and IE are the security monsters. We have to blame MP3.

      I don't see anything in the summary or article that blames mp3s, so I'm really not sure what you mean by that.

      • Re: (Score:3, Informative)

        by Doc Ruby (173196)

        Windows lets the unsafe ASF files appear to the operator to be safe MP3.

        The last time I opened a file in Windows Media Player that had an incorrect extension it warned me of the fact, giving me the option of not playing it.

        This report says that safeguard fails.

        But of course, we can't say that Windows and ASF and IE are the security monsters. We have to blame MP3.

        I don't see anything in the summary or article that blames mp3s, so I'm really not sure what you mean by that.

        The title of this story is "Worm Tran

    • I'm glad someone else mentioned this. Seriously, how braindead do you have to be to actually think that a file extension means anything as to the format of a file?

      Worse, even FOSS is going in this direction (Just tested with Gnome. It doesn't update the icon until you've already tried to click-execute it and it attempts to open a text file named foo.jpg as an image) :(

      I'd expect this kind of braindead stupidity from MS, but geez.

    • by qoncept (599709) on Friday July 18, 2008 @10:18AM (#24242871) Homepage
      The original post seems to be pretty carefully worded so as to not imply that mp3s are the problem. Where is anyone blaming mp3s?

      I had to reread because after a once through it seemed there was no risk to me, as I don't download wma/asf. Then I realized it said the extension remains the same. Which makes sense -- I know Windows Media Player will open any supported media type by reading the headers, and double clicking on a file with a media extension will open WMP. So there's your problem -- WMP, not Windows.

      Then I also remembered that I'm not using Windows anymore, so I'm safe after all.

    • by Thelasko (1196535)
      To quote Wikipedia: [wikipedia.org]

      Advanced Systems Format (formerly Advanced Streaming Format, Active Streaming Format) is Microsoft's proprietary digital audio/digital video container format, especially meant for streaming media. ASF is part of the Windows Media framework.

      Well there's your problem!

  • ...apart from the ActiveX and the email program which auto-runs attachements and the music files which can launch the browser and the RPC daemon which can't be firewalled and the universal plug and play daemon which allows "drivers" to travel around networks and....

    Defective by design.

    • Wrong. "Defective by design" means crippled by design (DRM). This is "Defectively Designed", which is a very different thing altogether.

  • by sootman (158191) on Friday July 18, 2008 @11:06AM (#24243673) Homepage Journal

    It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container, and adds links to further copies of the malware, all without modifying the .MP3 extension. [emphasis mine]

    So if this is correct, I figure one of two things is happening:
    1) It renames the file blah.mp3.asf, but if you have extensions hidden, it will hide the 'asf' and show the 'mp3'
    or
    2) it is an asf named blah.mp3 but when WMP opens the file, WMP says "Who cares what it's named, I can see that this is an ASF so I will go ahead and play it."

    Anyone know which it is?

  • The original article is rather overblown by the real-world behavior here. I just whipped out a WMA file with a URL marker, renamed it to .mp3, and tried it to see what would happen.

    With Windows Media Player 11 installed (out as an optional update for two years for XP, and default in Vista):

    Trying to open up an ASF file with a .mp3 extension prompts a dialog reading:

    "The file you are attempting to play has an extension (.mp3) that does not match the file format. Playing the file may result in unexpected behavior."

    So, if a user opened one of these files, they'd have an immediate warning something was up.

    However, if they play the file, nothing will happen if the player is in the stock state. Script commands don't run unless the user has gone into Tools > Options > Security and checked the "Run script commands if present" (which is off by default).

    And if a user somehow got one of these modified files AND has ignored the first dialog AND changed the default security option, all they're going to get is a new web page opening up in the default browser, which would then be subject to other security on the machine.

    So, current Windows installs appaer to be secure by default against this exploit.

    • WMP 9 is good too (Score:3, Informative)

      by benwaggoner (513209)

      I launched up a VPC session with XP and WMP 9 installed, and verified the same behavior:

      Warning that the extension doesn't match the content

      Script command execution off by default.

      Since WMP 9 is installed with XP SP 2, this suggests that SP 2-3 and Vista should be unaffected in stock state.

  • This kind of thing is why I eventually included WMP among the software I banned back in the late '90s. When I realized the danger of Microsoft's HTML control I banned everything that I could find that used the HTML control on untrusted content. This wasn't really an issue for early versions, but most later versions of Window Media Player were tied into the HTML virus distribution ecosystem. Well, Outlook and Internet Explorer soon proved me right in doing so, but up to now Windows Media seemed to have pretty much dodged the bullet.

  • by Snaller (147050) on Friday July 18, 2008 @02:50PM (#24246727) Journal

    To user mplayer to play your files.

  • by PPH (736903) on Friday July 18, 2008 @02:51PM (#24246751)
    ... this goes like:

    (Blah, blah blah blah, blah) codec (blah blah, blah. Blah.)

    [Allow] or [Cancel]

Living on Earth may be expensive, but it includes an annual free trip around the Sun.

Working...