New trojans use DRM

Quote:

---

PandaLabs has detected the appearance of two new Trojans, Trj/WmvDownloader.A and Trj/WmvDownloader.B, which are spreading through P2P networks in video files. These Trojans take advantage of the new technology incorporated in Microsoft Windows Media player called Windows Media Digital Rights Management (DRM), designed to protect the intellectual property rights of multimedia content. When a user tries to play a protected Windows media file, this technology demands a valid license. If the license is not stored on the computer, the application will look for it on the Internet, so that the user can acquire it directly or buy it. This new technology is incorporated through the Windows XP Service Pack 2 + Windows Media Player 10 update.

---

http://www.pandasoftware.com/about/p...x?noticia=5818

All I can say is.. Muhahahahahaah !!

Quote:

---

Even though these Trojans have been detected in video files with extremely variable names which can be downloaded through P2P networks like KaZaA or eMule, bear in mind that they can also be distributed through other means, such as files attached to email messages, FTP or Internet downloads, floppy disks, CD-ROM, etc.

---

So a website with an embeded wmv could even infect your Windows XP SP2 WM10 box when you are surfing with FireFox :p

Kind of sad when the sex video comes with a Trojan ;) (Think condom company)

lololol Safe sex.

Hahahahahahahahahahaha.

This is funny as ****. So is Xine affected? No? Ah well, back to whatever I was doing.

Ehm.. nope.. WM10 only (as far as I know)

The Register makes me think more like the DRM part only leads one to the trojan-ed pages and lets IE bugs do the rest..

Quote:

---

If the user runs a video file that is infected by one of the "DRM Trojans", they pretend to download the corresponding license from the net. In reality users are redirected to sites that take advantage of Windows vulnerabilities to download spyware, adware, premium-rate diallers and other viruses onto victim's machines.

---

http://www.theregister.co.uk/2005/01/13/drm_trojan/

Does anyone have any information on how this actually works? I've been searching google but all i can come up with is news accounts and not any actual information. I know DRM uses WMP to launch a website, but what does it do from there? Is an exe downloaded? Could it be a specially crafted License Key? Perhaps it spawns a website that uses Microsoft vulnerabilities in order to infect the said system? I'm very unfamiliar with DRM systems and I'm curious to know how it actually does it's dirty work. Panda wasn't really any help at all. Even in it's technical specs it basically dumbs it down and says "WmvDown.A creates several files, belonging to the malware it installs in the affected computer." Its a no sh*t sherlock description. Any one have experience with DRM licensing who might be able to shed some information?

Thanks

It works like this...............You download a file, music/film, what ever. That file is protected with DRM tech. To play that file you must have a license, if you have not got the license WMP will go to a web site that offers you a license to view/listen to that file. WMP then, assuming you purchase, downloads the license file..................................That file could be anything, trojan perhaps.

The flaw is down to the way WMP authenticates the original file and it's supsequent license.

Pretty much what Jinxy says, but I'll address it in somewhat more depth.


Most files have several streams. One is the audio stream, and has all of the music data in whatever compression codec is used. Another can be the video stream, again compressed however it was encoded. These are the most common, as every music file has an audio stream, and every video has to have a video stream, etc. The more uncommon stream encountered, that is used a lot in DRM protected files, is the Script Commands Stream. Basically this is another stream that can do things like display captions for music/video, and force Internet Explorer to open certain URLs. (There is also Meta Data, but that isn't quite a stream. There may be more, but these are the ones I understand.)


The problem is that Windows Media Player uses Internet Explorer as the default browser, and it is even embedded inside of Windows Media Player. If the website it goes to can do nasty stuff to Internet Explorer, disaster is going to happen when WMP goes to it. These media files (and their Scripting Streams and DRM License URL's) tell WMP to open up these kinds of websites.


These streams aren't limited to Windows Media Player, and this isn't the first time these things have happened. WinAmp's own NSV streaming format has similar streams (Scripting Stream), and AOL has made it a pain in the ass to disable them, although it is (was?) possible. Basically WinAmp also embeds Internet Explorer, and that causes problems when Internet Explorer goes to them...

Microsoft Corp. says it has no plans to change the way its Windows Media Player handles the download of DRM licenses.

Quote:

---

"Not every problem comes with an automatic technology solution. In this case, the priority is to educate users and get them to understand the importance of not downloading files from untrusted sources," said Mike Coleman, lead product manager with Microsoft's Windows division.

"If strangers are trying to entice you to open a file, chances are they're setting you up for a bad experience. We need to continue our work on getting people to understand what's going on and get them to develop better download habits," Coleman told eWEEK.com.

---

http://www.eweek.com/article2/0,1759,1751324,00.asp

Ehm... Yeah, right...

Thanks for the responses guys, i just have a follow up question, mostly for Tim_Axe, So the main route of infection is kind of akin to the Iframe exploits that hit just awhile ago, except using WMP instead of ad sites as a carrier? I'm mainly wondering if there is a particular file extension to these licenses, and if the "virus", so to speak, is downloading straight .exes or self extracting zips and executing them locally, or if it is taking advantage of already existing explorer holes in order to do its dirty work. another way to put it, is it utilizing Web Pages as its main point of infection, or if it is somehow scripting to download all the individual .exes and executing them? sorry if my question is kind of confusing, but i'm mainly wondering if its the webpage itself doing the dirty work, or if the license process itself is doing the dirty work. an easy example is a CD-R. If it Autoran, would it be a straight execution in the autorun file, or would it be in the launching of an IE window containing some nasty code (very non related subjects but it helps you get my drift) i'm planning on setting up a proof of concept just to see how easy it is to do.

there is supposed to be some a proof of concept..
http://www.benedelman.org/news/010205-1.html
I didn't want to try.

I haven't found it and my kaffeine player in kde's konqueror didn't play the video's and neither did mplayer in firefox.

Quote:

---

Originally posted here by the_JinX
Microsoft Corp. says it has no plans to change the way its Windows Media Player handles the download of DRM licenses.

http://www.eweek.com/article2/0,1759,1751324,00.asp

Ehm... Yeah, right...

---

http://www.pcworld.com/news/article/0,aid,112045,00.asp
You think if something like this old attack started spawning through this DRM vulneribility they might chnage there tune?

Great find Jinx, i'm running linux at home as well (FC2) so i wasn't able to screw around with it as much as i would like to, i have to get my other HD back from my friend or use another PC and drop a XP SP2 install on it. I didn't even consider the ActiveX control side of the webpage, but thats kind of odd because you would think with SP2 that it would raise a few eyebrows, and maybe a nice notice of that would be good (cough cough, panda, cough cough). A codec disguise is very clever, i have to say. Now to have some fun >:-)

So... Does anyone else find it kind of ironic that this product, (DRM), was supposedly created as a "security" application, (for the greedy), has, in short order, become a security vulnerability for the innocent?

Kinda like "My ****'s protected, screw the idiot that makes a mistake and downloads from a site he doesn't know is legitimate. I'm not paying for the technology to be written securely, just securely enough so I can fly to the Bahamas whenever I like"....

This half assed crap produced by people who rake in dollars but have the business acumen of a retarded gnat not to notice that the world is changing around them then get this knee-jerk reaction to a few percent drop in profits and risk a much larger percentage of thousands of others Gross Domestic Product, (thier income), getting their computers fixed just because they want that absolute top end bottle of champagne every night rather than the one costing a dollar less bothers the **** outta me.... :mad:

That and their crying to the legislature that they need to be protected by law because they were too stupid to see the changes taking place in front of their very eyes.... that's not capitalism - it's state handouts - which equates to corporate communism..... But then maybe I'm nuts.....

hey your not nuts, i recall a south park episode regarding that (i'm slippin in my fandom, i can't even recall the show name, it was in season 7 though) and a little band named "moop".
"they just downloaded a few songs, whats the big deal?"
"WHAT'S THE BIG DEAL!? Let me show you something." following quote same guy
"Take a look at Britney Spears"
"Why is she crying?"
"That's because she has to sell her brand new Leerjet with built in Plasma Screen television with built in DVD player. Because you guys think it's 'Not a big deal" to download her songs, she has to settle for a 2 year old Leerjet with only a big screen television and seperate DVD player."
"Oh my god, that's terrible!"
"It's a terrible thing when artists are expected to live only moderately rich lives"
(Paraphrasing, again, my fandom is slipping)

Maybe the RIAA made it so people wouldn't download things?


After using a cracked version of Kazaa to download music this is nothing to put past them.

Just like how I think Anti virii companies come up with new viruses to k eep their products selling. I mean even if they did they could get away with ti saying "We were testing how well the software found things that didn't yet exist".... Which they already do have sofwtare for. Sounds like a valid idea.

In either case I don't give a ****. This just continues the idea that Windows is a tax on stupidity.

Just a little tip for those who download via p2p. I've been doing it since I downloaded a file that had to contact the licensing server and rejected me.

Filter out .wma and .wmv from your searches.

Chances are... if its on a p2p network, its going to be in multiple formats. :)

Quote:

---

This just continues the idea that Windows is a tax on stupidity.

---

Maybe... But what happens when *nix becomes the industry leader? Oh well, it will become the same "tax on stupidity".

As I just showed here there are only really four skills required by a network admin on a windows system to mitigate 80+% of all vulnerabilities on commonly used window inplementations. Unfortunately I am too stupid to be able to assess all the vulnerbilities in the three most common versions of Linux, and determine the mitigations available prior to a patch.... Would you like to enlighten us all? It's perfect for you... You have a good grasp of the *nix systems.... Do it "fairly" and we can compare the results.... Game on? ;)

DRM protected files are able to tell Internet Explorer where to go to get a license. So if a naughty file says to go to a website that takes advantage of Internet Explorer vuln, WMP will do as it is told.


Apparrently if you can get a DRM profile created (I think this is beyond Microsoft's Control) you can use any URL you want for the user to "get" the license. (The license *must* be retrieved before the file can be decoded and played back) Of course, being the naughty files they are, a license won't be found there, but some rather unpretty stuff instead. (The user can't play the file because there is no valid license to decrypt/play it) Since I can't register a DRM profile or edit these files, I can't make an example opening http://www.google.com. But you might find this MSDN Article of Interest:

http://msdn.microsoft.com/library/de...ectcontent.asp


Cheers.

Sure tiger. Can't tonight though because I have to be up early again but maybe Sunday or something? Maybe we can put a post together discussing it.

Quote:

---

Maybe the RIAA made it so people wouldn't download things?


After using a cracked version of Kazaa to download music this is nothing to put past them.

Just like how I think Anti virii companies come up with new viruses to k eep their products selling. I mean even if they did they could get away with ti saying "We were testing how well the software found things that didn't yet exist".... Which they already do have sofwtare for. Sounds like a valid idea.

In either case I don't give a ****. This just continues the idea that Windows is a tax on stupidity.

---

you said it dude ,you said it .

could not be more correct!!!!1

Gore: Yeah, I'm up for that.... As long as it doesn't get turned into a "My OS is.... " thread by others it can probably be useful for a lot of people. Go for it, take your time and when your ready drop me a PM.

So... Gore... which flavors do you want to pick.... Yeah, these are 2005 so they don't count.... But they look remarkably similar to several M$ vulnerabilities.... Let's name the three flavors up front.... otherwise you could pick and choose.... What's considered the three _most_ installed flavors of *nix?

I read this