Just wondering. but are there any viruses which can be implemented into audio or video files, for example .mp3 .mpg etc...
As far as I have researched I have found none, but just want to check!
J_K9
Printable View
Just wondering. but are there any viruses which can be implemented into audio or video files, for example .mp3 .mpg etc...
As far as I have researched I have found none, but just want to check!
J_K9
In short.... No
google search
These files are "content" files. As such they are not executed but the contents are displayed by the associated program file.
As with the recent .jpg vulnerability the file that can exploit the vulnerability is malformed, thus, techincally, it isn't a jpg file... it's simply an exploit disguised as a jpg file.
i believe *.asf are capable of opening webpages so i wouldnt doubt it
also i wouldnt put it past mp3 files either..its reading the file transalting 0's and 1's to audio.....maybe if you found an exploit in an audio player i would think it possiable.....weirder stuff has happened
Thanks. You have all confirmed my thoughts that mp3 viruses don't exist, and I think I've learnt something!
Thank a lot!
J_K9
wasn't there a problem with Windows media WMA files.(suprise suprise). and this could be carried across to MP3 when the ïnfected" WMA was converted to MP3.. could have been a proof of concept or just a vulnerability report.. I can't find the info just now..
Cheers
I suppose the point I was trying to make is that it matters not what the file extension is. If a non-executable file is malformed, deliberately or not, then it is not longer a file of the type it purports to be by the use of it's extension.
Thus if there is a vulnerablity in the application that runs the files of a given extension then the application can be exploited by the _malformed_ file. Strictly speaking the "virus" has not come in the form of a file of an appropriate file structure but merely in a file that purports to be of an appropriate structure.
IMO, this is a serious failure in the security model. Allowing programs to act upon files while relying only on something as arbitrary as the file extension is a mistake. Common file types should have recognizable headers, (most do IIRC), and double clicking a file should initiate an application that checks the headers for validity and then calls the appropriate application and passes the file to it as parameter. In this way the file extension becomes irrelevant. Furthermore, if the header is unrecognized it would be no harder to associate the header to the appropriate application than it is to associate the application to the file extension as we do anyway. File headers that approximate a known header type but are "malformed" could then be flagged by to the user as potentially harmful and even be blocked if they are encountered in the future.... There's the GDIPlus.dll issue fixed.....
You could argue that you could name a file picture .jpg when it is actually an executable .exe file and the application checking the headers would simply run the file thus leaving a huge hole for social engineering..... It wouldn't be difficult to have that application check the header against the extension and warn, (or even double warn to avoid mistakes), that the file extension is of a benign type but the header is that of executable code and that you should not continue unless you are sure the file is safe......
Next problem please..... ;)
It makes sense, to me at least, and is simple but effective, and the simplest things work best! ;)
Tiger Shark - Have you submitted this idea to MicroSoft? If not, you certainly should.
Can any one see any potential problems with this? It seems so obvious I can't believe it's not been implemented!
I'm pretty sure that this has been thought about and for some reason that I am too dim to come up with at this point they haven't done it....
OTOH, if it's this simple and they haven't thought about it then I'm a genius..... :cool:
I may have misundertood the information at the time seems I have on the JPG problem..
The JPG file vulnerability is AFIK a header corruption.. meaning that any picture can be corrupted.. as with what I undersood about a vulenerability with Windows media files.. this problem would then be carried across to a resulting MP3 file IF it was converted from an infected WM file.. for the life of me there was a thread on this matter on AO some bloody where.. I don't have the time or patients now to stuff around searching for it..
AS for what TS is saying about File header information is true.. and there was a bug in WM9 that would allow it to execute a file: ie. an exe renamed as MP3 or WMA.. so any MP3 or WMA virus would be working on a weakness in the media player.. be it malformed header, or just renamed file..
cheers
"and the candle flickers brighter for a second only to return to normal dim glow...." could be this effect..Quote:
if it's this simple and they haven't thought about it then I'm a genius....
Undies:
When the header is corrupted in a malicious way then what follows in the rest of the file is not a .jpg. It's a buffer overflow followed by the exploit code. Thus it isn't a .jpg... It's a POS masquerading as a jpg.... hence my comments on the failure in the security model. It's not a problem with .jpg's it's a vulnerability in the associated application that is being exploited by people who lie about the nature of the file structure. It's really close to social engineering insofar as people "trust" .jpg's. But the exploit is part social engineering and part exploitation of an OS that depends upon a file extension to know what to do with it rather than assessing the file header in conjunction with the extension and determining a course of "sensible" action....Quote:
The JPG file vulnerability is AFIK a header corruption.. meaning that any picture can be corrupted..
How many times has this happened in my life already.... I get brilliant ideas only to find that the wheel was re-invented last week..... :eek:Quote:
"and the candle flickers brighter for a second only to return to normal dim glow...." could be this effect..
I'm sure someone is trying.......
There were a couple of virus' that messed with mp3 files. Copied them to root of C:\
VBS.Annod.B - copied itself to an mp3 file (like_a_virgin.mp3 & don't_cry_for_me_argentina.mp3) (info courtesy of Symantec)
Thanks everyone, espescially TS for all the info. Basically, the infected executable file(s) can be converted to .mp3 for example and then when I open it I'm scr3wed. Thanks everyone!
J_K9
There is also the following information: (which relies on a bug in older versions of winamp)
http://www.securiteam.com/windowsntf...EP0O2K6UC.htmlQuote:
It is possible to modify an existing MP3 file in such a way that it can carry a virus. The virus is activated when the MP3 file is played in Winamp and can then infect other MP3 files found on hard drives or network shares. In order to protect yourself you need to upgrade to Winamp 2.80 or disable the minibrowser.
I haven't ever seen this used in the wild
As you probably know a WMA file can contain "Active content" meaning it can contain javascript, vbscript etc. If you rename said WMA file to MP3 Windows Media Player will happily play it, including the active content.Quote:
Originally posted here by Und3ertak3r
wasn't there a problem with Windows media WMA files.(suprise suprise). and this could be carried across to MP3 when the ïnfected" WMA was converted to MP3.. could have been a proof of concept or just a vulnerability report.. I can't find the info just now..
What the hell were they thinking?
Hey, I know a cool feature. Let's put active content in otherwise benign media formats :rolleyes: