Security expert warns of MP3 danger

[micael]

What's the next move for the viiri writer? Seems like nothing will be holy in the future :rolleyes:


Security expert warns of MP3 danger

New technology such as MP3s may soon be used as vectors for viruses, a security specialist visiting Australia has warned.

“We've recently been looking at how things embedded into MP3 files might become a problem,” Vincent Gullotto, vice president of AVERT -- the developer of McAffee anti-virus systems -- told ZDNet Australia. “There will soon be MP3s that will play the video clip at the same time as the music, and if you can embed movie files to MP3s you can embed Java and other languages that may contain malicious programming.”

The full article can be found here. (http://zdnet.com.com/2100-1105-861995.html)

[VanEck]

i am glad someone has finally brought this to attention. as to my knowledge, there has not been any outbreaks of of viri embedded in an mp3, just an occasional virus pretending to be an mp3 and people not paying attention to file extensions. but embedding "in" and not just binding is something i have been forseeing for the last year or so. no one has really paid it much mind though. what better way for a malicious coder to spread a virus? everyone and even their mothers know how to file share these days. mp3's and porn are the two most common type of shared files.

[ArmyOfOne]

yeah, If you go on Kazaa or Morpheus 25% or so of MP3's are viruses and 50-75% of porn is... High rate for someone who doesn't have a virus scanner... does NAV stop them???

[{P²P}Apocalypse]

Oh great. Time to throw the RIO in the trash.

Thanks for the post. Interesting read. However the biggest virii out there right now is called the Win32 platform...<grin> :D

[micael]

Im not a expert in the MP3 format.. But Vincent Brobalds comment seems likely, can someone with better experience then me verify this?


Source: TalkBack, Vincent BROBALD (comment on the original article)

So far, from what I know, MP3 file format is safe.

The security problem comes from wma files (microsoft "technology") that enables to embed other elements (scripts,...).
Once renamed to mp3, those files seems just as real mp3 files for windows mediaplayer... More: Windows mediaplayer plays the files as it recognises the data streams inside the file. (same irresponsible features like the possibility to rename a .exe to .bat and still being able to execute it as a binary). A simple workaround would be to make Windows mediaplayer read only .mp3 files containing real mp3 data streams.

Real MP3 files are not (to my knowledge) dangerous... But not all .mp3 named files are real MP3 files, and some hostile false mp3 files will execute thanks to Microsoft.



Source: TalkBack, John L (comment on the original article)

So, this is more an issue with Windows Media Player than mp3's? That would make sense. The only part I was not seeing was how someone would get code in an mp3 to execute, but if Media Player does that on its own, then there could be a problem. Of course, this problem is more a Media Player issue than an mp3 issue... and will only affect those who use Media Player to play untrusted content. People like me who use programs like Winamp on Windows, or any of the various mp3 players on Linux will not be affected =). Yippee!

[the_JinX]

Originally posted here (http://www.AntiOnline.com/showthread.php?threadid=222293#post477221) by micael
There will soon be MP3s that will play the video clip at the same time as the music

there already are... they are called MPEG hehehe..
first there was mpeg (1)
then they took the third layer (the audio layer) and named it mp3 for mpeg 1 layer 3 audio...

[micael]

That's true :D.

But what about the potential risk to embedd other malicious code to a MP3, is that possible ?

[Noia]

As long as it is in pure MP# then it's not a problem, but once they start adding "Features" to it or calling *.wma's *.mp3's then you have aproblem, coz wma files are about as secure as the resto of windows.....CRAP

If people start to corrupt the sanctuary I have in my Mp3's I'm going get really pissed off.....

Let's all Pray it doesn't happen....
(Skip the Praying part...)

- Noia

[micael]

I guess it was time to add a good content scanner to my system..

"Are this a real MP3 or a M$ security issue :)".

[gstudios]

Could this be the doings of the RIAA? :)

[the_JinX]

I'd guess so.... ;)

[Mantix]

they should create a mp3s (mp3 secure) that dosen't allow modofying or inserting of programs

[Terr]

In a way, I would consider this not-quite a virus. I mean, any malicious code would be interpreted code, that is, actions taken by the playing program. It's not executable, and so long as people don't design IRRESPONSIBLE programs (*cough* Microsoft *cough*), it will be a non-issue. I mean, this is just as deadly as warning about viruses in text files, or macro viruses, or viruses in pictures. So long as the interpreting software is not made with handy-dangle-standard-breaking features which are ill-thought out and un-necessary, it won't be so much of a problem.

[masterpe]

My borther wanted to burn a cd with a mp3 with a virus. The burner doesnt close the cd and just stops at the middle of the cd.

[Mucolaca]

ur brother wanted to do what?

[masterpe]

To burn a music CD

[ihsir]

now if you can do that to mp3 files ( reference to orig post ) then any file can be made into a virus.

is it really possible to that?

[uzerfrendly]

i dont think that the mp3player virus would be that big of a threat because most users have backups (and virus scanners to protect those hopefully) on their comp anyway. The only 2 problems that would be truly worth worrying about would be:
1]a virus that overloads the mp3player harddrive and damages it (not sure how that would werk but its a risk)
2]importing the mp3s to a computer without a (uptodate) virus scanner

Can anyone think of any other harmful things a virus could do?

[dspeidel]

I went 2 days w/o a virus scanner and used the Kazza network and my system got infected. Norton cleaned it up. I find that they put viruses in mp3s and mpegs annoying I also dislike the browser pops I'm starting to see as more common in mpegs.