said by eburger68 :

The technique exploits features of the Windows Media DRM functionality to launch special Internet Explorer windows that display popup ads and that also attempt to download and install adware/spyware. This happens when the user opens the Windows Media file for playing.

said by edbott :

I have not identified any circumstance in which this exploit can install software on a computer that has a properly patched version of Internet Explorer. The victim must specifically click a button to install the spyware.

said by edbott :

The programs in question are digitally signed and are from known companies. The terms of service make it clear what you're getting. It takes one click and 10 seconds of reading to realize that the correct answer is no.

said by edbott :

The installation mechanism uses social engineering tricks that could fool a naive user. These are the same tricks that are used on Web pages (especially porn sites) to install spyware.

said by edbott :

You are most likely to acquire one of these "poisoned" WMA files from a peer-to-peer file-sharing network. The risk that you will get a file like this from a reputable music seller that uses digital rights management is as close to zero as it is possible to get.

said by edbott :

If you use Windows XP with Service Pack 2 and Windows Media Player 10, you are completely protected.

said by edbott :

If you have restricted ActiveX programs from being installed on your computer, you are completely protected. If you have assigned a program other than Windows Media Player to play back Windows Media content, you should be protected as well, although I didn't test this scenario.

said by edbott :

Clearing the option to acquire software licenses automatically seems to have no effect on this exploit.

said by edbott :

I don't see this as a new and horrifying security risk, the way some observers do. This is yet another variation of the tried-and-true tactics that spyware providers have been using for years to push their crap: social engineering combined with ActiveX "push" installations. I urge Microsoft to patch this behavior for Windows Media Player 9, but anyone who is aware of current security practices shouldn't fall for this stuff.

said by eburger68 :

I don't think it will be too long before we start seeing these WMA files outside of P2P networks -- on porn sites offering free "sneak previews," for example, but also on apparently legitimate music sites offering free and legal samples of music available for legitimate download and purchase. Indeed, one can easily spin out a whole raft of potential uses for this particular "feature" of WMA files.

What this does is open a whole new adware channel for web sites and companies looking for new sources of advertising revenue. If you're running a music site, for example, no longer do you have to mar your main web site with sleazy drive-by-downloads -- now you can bundle adware more discretely through the media files offered by the web site. And think how remarkable it is that Overpeer has decided to turn to adware to improve its financial base! Will others start to follow that example? Let's hope not.

said by eburger68 :

The real story here is Microsoft's poor implementation of DRM. Indeed, the truly cynical could now point out that the standard, illegal MP3 files that populate P2P networks are in some ways more secure than Microsoft's DRM-enabled WMA files. And that's a sad commentary on the industry's efforts to persuade consumers to accept DRM-enabled content.

said by WFO :

LOL..Windows Media Player doesn't even get internet access on my laptop.:D

said by edbott :

wbpdp.balance.gator.com (gee, what a surprise!)