Worm Transcodes MP3s To Infect PCs 385
snydeq writes "Kaspersky Labs has discovered malware that inserts links to malicious Web pages within ASF media files, posing a danger to Windows users who download music files from P2P networks. Infected files launch IE and load a page that asks the user to download a codec. The download, a Trojan horse, installs a proxy program to route other traffic through the PC. The malware also has worm-like qualities, according to Secure Computing. It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container, and adds links to further copies of the malware, all without modifying the .MP3 extension."
wow, that's evil (Score:5, Funny)
Wow, that's evil, even for malware authors.
Re:wow, that's evil (Score:5, Insightful)
Re:wow, that's evil (Score:4, Funny)
I want the RIAA to be DEEPLY investigated,prosecuted with a fair trial and a decent hangin'.
The music industry is terminal.It's lashing out in its dying breath.
Just run your antivirus over your downloads before playing.
Let's just go ahead and keep killing the industry so musicians can have a level playing field and we can do away with the corruption and misdirection to mediocre talent it provides.
Re: (Score:3, Insightful)
Do you really believe this would be effective?
Wouldn't it be more important to run your antivirus on your codecs before installing?
Re: (Score:3, Interesting)
At the very least, don't play your MP3's with Windows Media Player.
Word does the same thing, opening files that are named with the wrong type, and not complaining about the mismatch. Rename a .DOC file with a .RTF extension, and double-click it. If RTF is associated with Word, then Word will open your file like a trooper, but won't say a word about the format not matching the name. Now, try opening it with a something that supports .RTF but not .DOC (there are a few out there) and hilarity ensues.
For a l
Re: (Score:3, Insightful)
How do you buy music from artists that are represented by the RIAA? Seems to me that most of the money you spend when buying most of the music the RIAA cares about isn't going to the artist in the first place.
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
Where did concerts come into this?
GGGP wrote "support music by buying from the artists" which then led to a comparison of alternate methods of supporting the artists, ergo concerts. A legitimate (OT) point, and not a straw man. However, between the venues, concert promoters and TicketBastard, the concert business is ripping off artist almost as badly as the recording labels.
When voting with your dollars, deciding where *not* to spend is every bit as important as where to spend. There is no substitute for doing your homework.
Re: (Score:3, Informative)
They bands still make far more money from touring than albums sold. To quote Maynard Keenan from Tool:
Seen here [theredalert.com].
I included that last bit for the sake of honesty. But the fact is they, and other big bands make more from touring than albums. I believe he also once said that they could simply tour and not do albums at all, and get along fine. But I couldn't find that quote.
Re: (Score:3, Informative)
That's not how it works. When you go to a concert, a promoter has paid for the venue. The promoter basically pays all of the expenses for the venue and promotion and what not, then contracts with the artist to appear at the concert that they've set up.
The artist more often than not will get a fixed fee for this performance with the promoter then pocketing all of the money they've collected from ticket sales minus the expenses of paying the venue, paying the artist the fixed fee, paying the promotional costs
Re: (Score:3, Interesting)
Or we could you know,take music back from the evil empire.Music is sound ,sound is free.Performance is work,work is rewarded monetarily.There is no use for a music "industry" except to rip off everyone from the artist all the way to you.
Stealing implies ownership.Music exists as energy independent of ownership.Music uses humans as a gateway to this dimension.Humans may be rewarded for acting as gatways not as owners of intangibles.Copyright is such a joke due to it's distortion
Re: (Score:3, Informative)
It's ludicrous to think that, should copyright disappear, the music industry would imme
Re:wow, that's evil (Score:5, Funny)
Wow, that's evil, even for malware authors.
That's nothing. I heard the next version will automatically go out the Web, sign up for an e-Trade account, and then proceed to buy stocks like GOOG, AAPL, RHAT, etc., and automatically sell them short.
Re: (Score:3, Interesting)
Well, that trojan has a bug. When you sell short, you sell a stock then buy it. Yes, really. [investorwords.com]
That's what "short" means -- you don't have all the shares you need to cover the sale, so you're short. A "naked short" means you also don't have the funds set aside to buy and deliver the shares you sold or enough shares of the company in your portfolio to make up the difference.
The idea is that you sell at or just below the current price, expecting the stock to tank. Then you buy the shares before the agreed-upon t
Re: (Score:3, Interesting)
He wasn't planning to sell it, or he wouldn't have let you borrow it.
I think this is the main part of it. Our Farmer Jones, whether he had apples or stock to borrow, is sitting tight on something valuable. He benefits in two ways.
1) You pay him. He's not going to borrow his stuff for free. The exact amount and conditions of the payment can vary greatly, but it'll be there.
2) What you are doing will result in more accurate the price for the stuff the Farmer has. Markets are in large part about setting the co
Re:wow, that's evil (Score:5, Funny)
It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container
Wow, that's evil, even for malware authors.
That's nothing. You should see the fix. Your anti-virus program will update its definitions, and if it identifies any of these files prior to download, it makes them appear in a Real Audio format so your never tempted to download them to begin with.
Re:wow, that's evil (Score:5, Funny)
No the ultimate evil is if... (Score:5, Funny)
Re: (Score:2)
Aargh! Stop it! I cannot take it anymore!
Re:No the ultimate evil is if... (Score:4, Funny)
Re:wow, that's evil (Score:5, Funny)
Because "WOOSH" sounds better in that format?
Re: (Score:2)
Re: (Score:2)
The summary already says that: "It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container"
Re:wow, that's evil (Score:4, Informative)
WMA, WMV and ASF are the very same container format. The only difference is the filename extension.
Re:wow, that's evil (Score:5, Informative)
ASF is the container, WMA is the codec.
WMA can be used to refer to the container [wikipedia.org], but it's actually an ASF container with a WMA track inside.
That's confusing, and basically the file extension refers to the codec, not the container. The WMA or WMV files you download are actually ASF files. It's about as logical as having the DIVX extension for AVIs with DIVX encoding, but hey... who's going to try to change it?
Re: (Score:3, Funny)
but hey... who's going to try to change it?
I will, in 10 years after I become batman.
ASF=WMA=WMV (Score:3, Informative)
Yes, same file format. It was originally called just .asf, but changed by default in the late 90's, IIRC, to different extensions for video and audio.
This enabled different icons for video and audio files, and easily filter between them so you didn't accidentally try to sync video to an audio-only player.
This is pretty standard practice. .m4a, for example, is a MPEG-4 file with just audio. .f4v is is a MPEG-4 file known to be compatible with Flash.
Re: (Score:3, Interesting)
Also, beware of any MPEG, AVI, or MP3 that is under a meg. And don't be stupid enough to download .zip, .rar, .exe, .scr, .wmv, .wma, .asv, or .asf files off of P2P networks.
Fairly good advice, but I'd modify it slightly...
First, use VLC; if you drag-drop a file into VLC you'll remain pretty safe even if the file is malicious. MPEG/AVI/MP3 files that are under a meg are still likely adverts, but they can't hurt you if you open them with VLC. WMV, WMA, and ASF are also likely adverts, but they can't launch their slew of popup windows if you open them with VLC. Also, VLC won't do anything bad if you drop "awsums0ng.mp3.exe" into it, it'll just say it can't play that. Double-click
Re: (Score:3, Informative)
Re: (Score:2)
It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container
Dammit. That sounds more interesting than any programming job I've gotten in the last 5 years.
Re: (Score:2)
Wow, that's evil, even for malware authors.
I think the summary missed a paragraph.
Re: (Score:3, Informative)
I hate to say "I told you so" but... Ok, I don't hate telling you that, but I hate that I was right. Damn it, I'm not a security professional, why could I see this coming but the professionals couldn't?
I've been warning people about using WMA files and Windows Media Player for years, the first I said of it was back when I had my old Quake site, the Springfield Fragfest. A security researcher who played Quake II saw the post, realised that I was right, and we had a rather scary email conversation. I've been
Scary Thought (Score:2)
Next thing you know the infected MP3 files will be loaded onto and playing on cell phones everywhere and we'll be running from crazied people who are addicted to You Light Up My Life....
Richard Stallman Says... (Score:4, Funny)
If you'd just used OGG, this never would have happened! ;-)
Re:Richard Stallman Says... (Score:5, Interesting)
We are moving into darker and darker times when it comes to malware. It seems to me that they are trying every evil alternative to make us and our computers to zombies.
How to remember the good old days when we could get the "Your computer is now stoned" or an east german ambulance with sound passing over the screen. Pretty annoying but relatively harmless.
Re: (Score:2, Insightful)
Yes, I too remember the days when there was little if any monetary gain to be had from writing a virus or hacking in general.
But those days are gone, there is money to be made... now that it pays to hack, the onslaught will only get worse.
Re: (Score:2)
I think GP meant to say "OGG/Theora", and not just OGG.
Re: (Score:2)
CDEX [sourceforge.net] works beautifully for Winders users. Nice and fast and ogg is one of the default formats.
Gentlemen, (Score:5, Funny)
I must applaud the RIAA on this occasion. I may have mocked their efforts in the past, but this is truly an impressive piece of work, worthy to be called a hack.
Re:Gentlemen, (Score:5, Insightful)
Nice (Score:5, Insightful)
Way to go Microsoft!
Is there anything these morons can't fuck up?
Re:Nice (Score:5, Informative)
For those of you who think this is just a troll, or are just unfamiliar with ASF:
It's like the ActiveX of multimedia wrapper files. A security nightmare? You bet. Does it still depend on user stupidity? Well, yes.
Re:Nice (Score:4, Interesting)
Re: (Score:2)
I think it's fine that a file has arbitrary content.
That the data is able to surreptitiously start network connections? Not so much. At least, the application should have the decency to inform the user before acting on its own.
This is a good example of why don't at all mind not-so-integrated applications, as it means I'm less exposed to this kind of "multimedia experience".
Comment removed (Score:4, Interesting)
hidden extensions (Score:5, Insightful)
I hate how Windows has hidden file extensions in every version since XP. It's supposed to make the machine more Mac-like and friendlier, but it is a serious security concern.
I try to turn it off on every machine that I'm asked to setup or fix, but occasionally I get someone who deletes the "unfamiliar" file extensions from their files and ends up not being able to open them.
Re:hidden extensions (Score:4, Interesting)
Re:hidden extensions (Score:5, Informative)
Re: (Score:2, Insightful)
If there is one thing that is guaranteed in life, it is stupidity. Count on that, and remove the other vectors.
Re: (Score:2, Insightful)
I wonder if it could work with other wrappers, like AVI, Quicktime, etc. Maybe not in their original state, but with slight modifications that could fool the player.
I wasn't aware of all the capabilities of the ASF wrapper, but that sure was a ticking time bomb.
Nothing New... (Score:4, Informative)
Re:Nothing New... (Score:5, Insightful)
You should turn in your geek card for falling for that one! Any site you don't 100% trust that asks you to install a codec for a file format you can play already screams 'malware' in a loud shrill voice.
Re: (Score:2)
That's good advice, but just because you can play the file format doesn't mean you have the right codec...
Re: (Score:3, Informative)
It means you have A codec that works, and all the player cares is that you have A codec that claims to work. If you can play the file format, you have both a working codec and a codec that the player knows about, so the player isn't going to tell you that you need to download another one.
Any WEBSITE that tells you that you need to download a codec when you already have one for that format is screamin
Re:Nothing New... (Score:5, Informative)
That's actually not true. It's less of an issue with audio file formats, but video file formats can contain video compressed with any number of codecs, and you need the correct codec to play them. For instance, if I can play raw
Any WEBSITE that tells you that you need to download a codec when you already have one for that format is screaming MALWARE,
You are correct that many malware websites use fake codecs to install their malware, but it's just not true that any codec will work for any given file format. Just because you can open the file doesn't mean you have the right codec to view the content. It has nothing to do with the "fastest" or "best" codec. If you don't have the right codec, the video won't play back at all.
Re: (Score:2)
Microsoft only threat? (Score:3, Interesting)
The ASF container is patented (Score:3, Interesting)
Also I don't know much about the ASF container but if you run it in another player like iTunes will it still activate?
The ASF container is patented in the United States, home of Microsoft Corporation, Apple Inc., and Slashdot. Microsoft wants to be the only vendor of ASF tools; to this end, it has cease-and-desisted VirtualDub's author from including ASF support. And Microsoft's ASF parser is, predictably, the exploitable one.
Re:Microsoft only threat? (Score:5, Informative)
Re: (Score:3, Informative)
yes you did... here right in the first line of your OP
Re: (Score:2)
That the Linux community is not a marketing machine is 100% a Good Thing to me. I would probably end up enjoying Linux less if there were a corporate financial interest that competed with the community's current interest in produc
Re: (Score:2)
True, but I've read some reports where ordinary websites are being unwittingly hijacked to spread malware. This makes it harder for ordinary users to know what to click on and what not to click on. It used to be you could play a sound file and be assured it was okay. Also hackers was able to inject malware without the visitor downloading anything. Personally, I visited some forums about gaming recently and got
Data vs Program (Score:5, Insightful)
Microsoft has a SERIOUS design pathology. They too often confused "data" with "program." Every G.D. thing in Windows can, in some way, initiate an action. This is a problem.
A "music" file should be data. E-mail should be DATA! This is absolutely crazy. Making everything capable of being interpreted as programmatic content is at best a security flaw.
Re: (Score:2, Funny)
You mean just have it read X bytes of data and stop!? But how would they have supercyberhyperwebbrowsing? I want gimmicks not reliability.
Re: (Score:2, Informative)
Re: (Score:3, Insightful)
Computer users (yourself included, me too!) have demanded more automation,
Speak for yourself. I don't want "automation" and most of my family and friends get confused by it, "Hey, why is it doing that?" is the typical response.
they want less user interaction, thus MS and everybody else will develop for these wants.
You are confusing "wanting it to work" and "automation." Clicking, or double clicking, on an icon in a window and having the correct player pop up and play the file correctly is what people want.
Re: (Score:2)
Perhaps you can substantiate how this "popular demand" was determined? By who? When? Where?
Application writers, advertisers and other assholes have wanted to make it easier, and preferably, automatic, for users to install their software. I don't know of any surveys of users on this subject.
Re: (Score:2, Informative)
This is the problem right here: Using corruptible information for a system-sensitive operation. WMP should only initiate such a download from a secure and authenticated source on the internet or us
Re: (Score:2)
A "music" file should be data. E-mail should be DATA! This is absolutely crazy. Making everything capable of being interpreted as programmatic content is at best a security flaw.
I'm not going to dispute that, I fully agree. In a sense, though, the infected "mp3" file is still just data... it's the codec library that's malicious. It's no different than files wrapped in that damned Zango codec that's basically just malware on top of an existing mpeg-4 decoder.
The splitting of codec versus player I think was a great development that's been pretty much made obsolete by huge storage space, GHz range processors, and codec packs like K-Lite and DefilerPak. My personal (and admittedly anti
Re: (Score:2)
What player? (Score:5, Interesting)
I have a feeling this exploit doesn't work in VLC.
A few days ago I played a movie in VLC on a Windows machine and half way through the VLC error log opened and had some interesting things in it. It was trying to place some files into some directories, and then lastly was trying to open a website.
So it wasn't able to do those things, but I can't help shake the feeling that if I had played it in Windows Media Player it would have done some damage. Though it could have also been an exploit for a specific player like Realtime, Xvid, etc..
Disclaimer: I'm not associated with VLC, although I do really like it.
Re: (Score:3, Insightful)
My question is how the hell that works? Why is it even possible to do that!?
Data comes in, gets split into an audio stream and a video stream. You look at the magical tags and figure out which decoder to fire up. Feed compressed data into the decoder, get decompressed data out. Pass the video data to the display pipeline, and the audio data to the audio pipeline.
There should be no way to execute anything from those pipelines.
Re: (Score:3, Informative)
a) ASF is patented, b) by Microsoft. (Score:5, Funny)
So ... I think we can deduce which players are vulnerable to this.
von Neuman rolls in his grave (Score:5, Insightful)
This is why you separate the executable code from the data.
Re: (Score:2)
I'm glad you were modded up. Running everything in a sandbox that disappears on reboot, and other methods to keep real data away from what your doing online is the what will make it safe(r). In the case of simply separating user data and system data, such malware still has a chance to truly fsck with you. The need is to keep online malware 'away' from your user data AND system data. To do that, you need to do the equivalent of putting on rubber gloves, mask, protective goggles and going over to your neighbo
For lack of a name, call it the RIAA worm. (Score:2, Interesting)
Hmmm, it sounds like this kind of worm really benefits the RIAA. It works like this: If all your mp3 files are encoded from your own CDs for legitimate purposes, then nothing will happen to you. But if you download a single song, or if you copy a single song from a friend, then BOOM! All of your music becomes totally jacked up. It seems a pretty sophisticated worm/virus concept and the transcoding of mp3s is kind of like an additional "fsck you" from the RIAA.
hmm... (Score:4, Funny)
Good thing I only download FLAC and transcode it myself to mp3... I mean, I buy cds straight from the RIAA for $50 a pop so I can bypass those greedy artists... yeah, that's the ticket...
They're ASF, Not MP3, Files (Score:5, Informative)
The buggy format is not MP3. The MP3 files are perfectly safe.
This worm transcodes them into ASF files. The ASF files are the threat. The ASF files pretend to be safe MP3s, but they include links that Windows automatically opens. MP3 files don't do that.
Of course, it's really Windows that's buggy (duh). Windows allows the worm to enter and run. Windows lets the unsafe ASF files appear to the operator to be safe MP3. Windows opens the ASF links to the bad sites. Windows then runs whatever the bad sites deliver to the browser (which the user could have just clicked to from another page, without the MP3/ASF worm at all, and just blown their system by Web surfing).
But of course, we can't say that Windows and ASF and IE are the security monsters. We have to blame MP3. Even though this exploit requires converting the file into something that's not MP3 before it can get started attacking you.
Re: (Score:2)
Windows lets the unsafe ASF files appear to the operator to be safe MP3.
The last time I opened a file in Windows Media Player that had an incorrect extension it warned me of the fact, giving me the option of not playing it.
But of course, we can't say that Windows and ASF and IE are the security monsters. We have to blame MP3.
I don't see anything in the summary or article that blames mp3s, so I'm really not sure what you mean by that.
Re: (Score:3, Informative)
This report says that safeguard fails.
The title of this story is "Worm Tran
Re: (Score:2)
I'm glad someone else mentioned this. Seriously, how braindead do you have to be to actually think that a file extension means anything as to the format of a file?
Worse, even FOSS is going in this direction (Just tested with Gnome. It doesn't update the icon until you've already tried to click-execute it and it attempts to open a text file named foo.jpg as an image) :(
I'd expect this kind of braindead stupidity from MS, but geez.
Re:They're ASF, Not MP3, Files (Score:5, Interesting)
I had to reread because after a once through it seemed there was no risk to me, as I don't download wma/asf. Then I realized it said the extension remains the same. Which makes sense -- I know Windows Media Player will open any supported media type by reading the headers, and double clicking on a file with a media extension will open WMP. So there's your problem -- WMP, not Windows.
Then I also remembered that I'm not using Windows anymore, so I'm safe after all.
Re: (Score:2)
Well there's your problem!
"Windows XP is our most secure OS ever" (Score:2, Insightful)
...apart from the ActiveX and the email program which auto-runs attachements and the music files which can launch the browser and the RPC daemon which can't be firewalled and the universal plug and play daemon which allows "drivers" to travel around networks and....
Defective by design.
Re: (Score:2)
Wrong. "Defective by design" means crippled by design (DRM). This is "Defectively Designed", which is a very different thing altogether.
A bit of clarification? (Score:3, Interesting)
It searches for MP3s, transcodes them to WMA format, wraps them in an ASF container, and adds links to further copies of the malware, all without modifying the .MP3 extension. [emphasis mine]
So if this is correct, I figure one of two things is happening:
1) It renames the file blah.mp3.asf, but if you have extensions hidden, it will hide the 'asf' and show the 'mp3'
or
2) it is an asf named blah.mp3 but when WMP opens the file, WMP says "Who cares what it's named, I can see that this is an ASF so I will go ahead and play it."
Anyone know which it is?
Details on actual Windows Media behavior (Score:5, Interesting)
The original article is rather overblown by the real-world behavior here. I just whipped out a WMA file with a URL marker, renamed it to .mp3, and tried it to see what would happen.
With Windows Media Player 11 installed (out as an optional update for two years for XP, and default in Vista):
Trying to open up an ASF file with a .mp3 extension prompts a dialog reading:
"The file you are attempting to play has an extension (.mp3) that does not match the file format. Playing the file may result in unexpected behavior."
So, if a user opened one of these files, they'd have an immediate warning something was up.
However, if they play the file, nothing will happen if the player is in the stock state. Script commands don't run unless the user has gone into Tools > Options > Security and checked the "Run script commands if present" (which is off by default).
And if a user somehow got one of these modified files AND has ignored the first dialog AND changed the default security option, all they're going to get is a new web page opening up in the default browser, which would then be subject to other security on the machine.
So, current Windows installs appaer to be secure by default against this exploit.
WMP 9 is good too (Score:3, Informative)
I launched up a VPC session with XP and WMP 9 installed, and verified the same behavior:
Warning that the extension doesn't match the content
Script command execution off by default.
Since WMP 9 is installed with XP SP 2, this suggests that SP 2-3 and Vista should be unaffected in stock state.
Odd that it's taken so long. (Score:3, Interesting)
This kind of thing is why I eventually included WMP among the software I banned back in the late '90s. When I realized the danger of Microsoft's HTML control I banned everything that I could find that used the HTML control on untrusted content. This wasn't really an issue for early versions, but most later versions of Window Media Player were tied into the HTML virus distribution ecosystem. Well, Outlook and Internet Explorer soon proved me right in doing so, but up to now Windows Media seemed to have pretty much dodged the bullet.
Another good reason (Score:3, Insightful)
To user mplayer to play your files.
To the non-technically savvy .... (Score:3, Insightful)
(Blah, blah blah blah, blah) codec (blah blah, blah. Blah.)
[Allow] or [Cancel]
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Not really , name the file: mymusicfile.mp3.asf , Windows does the rest for you.
Re: (Score:2)
Being able to make an asf look like an MP3 is...weird. If true then that is going to spread very quickly.
I suspect as a "feature" built into Windows Media Player to make things "just work" if a .asf file has the extension .mp3 WMP will detect that the file is a .asf file and play it anyway.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Excuse me, I guess I should have put:
One should not be downloading things, especially things that are copyrighted and/or executable, from P2P networks.
Is that better?
Re:Dont use untrusted codecs! (Score:5, Insightful)
The irony is that in all these years, I don't think I've ever seen WMP successfully find and install a codec it was missing. I just end up with a message saying it couldn't find the codec that doesn't even tell me which codec it was looking for. Then it turns out this all just another malware attack vector.
In 2000, this problem would have "more of the same" but the fact that this still exists in 2008 is insane. I mean Microsoft publicly admitted their security is awful in 2000, took four years to make a decent attempt to correct things, and yet here we are four years after that...
Thanks, Microsoft. Thanks a lot. You give new meaning to word FAIL on a daily basis.