how-to block ads
|
|
Uniqs:
26834 |
Share Topic
 |
 |
|
|
|
4 edits | WMP Adware: A Case Study in Deception
WMP "Security Upgrade" | 
"License Acquisition" | 
"Ultra Web Host LLC" | 
"Required Media Player Version 9 Browser Update" |
As you all know, it was recently discovered that Windows Media Player (WMP) files can serve as the vehicle for spyware and adware installations (see »Adware Installed through WMA Files ). Ben Edelman and Ed Bott have documented the installation process on Windows XP, including Windows XP SP2 -- see:
Ben Edelman: Media Files that Spread Spyware
»www.benedelman.org/news/010205-1.html
Ed Bott: "Poisoned" Windows Media files: more details
»www.edbott.com/weblog/archives/000340.html
For those who have not followed this story, researchers have discovered specially designed Windows Media Player files that will initiate the installation of spyware and adware when users attempt to play those files. These specially designed media files exploit the DRM (Digital Rights Management) functionality that Microsoft built into Windows Media Player by opening web pages in hosted instances of Internet Explorer. The ostensible purpose for opening these special Internet Explorer windows (which resemble dialog boxes) is to acquire license information needed to play the media files. Once open, though, these hosted instances of Internet Explorer can be used to initiate the download and installation of spyware and adware, just as happens in drive-by-downloads at regular web sites.
Windows XP SP2 vs. Earlier Versions of Windows
As Ed Bott has noted, Windows XP SP2 does offer some protection against this exploit, provided users are also running Windows Media Player 10. On Windows XP SP2 w/ Windows Media Player 10 the special Internet Explorer window that opens when Windows Media Player attempts to acquire license information for the media file will behave just like any other instance of Internet Explorer when web sites inititate the installation of ActiveX controls. That means SP2's Internet Explorer will automatically block the installation of those ActiveX controls and display summary information in the SP2 Information Bar, thus lessening the possibility that users will be bamboozled into consenting to the installation of unwanted spyware and adware.
If users are running Windows Media Player 9, however, those XP SP2 security enhancements will not protect users because, as Ed Bott observes, the "instance of IE that is being hosted in the WMP9 License Acquisition dialog box is not interacting properly with the security restrictions in SP2." Instead of seeing the XP SP2 Information Bar, users will see the standard ActiveX Security Warning box -- common to earlier versions of Internet Explorer -- prompting them to install software.
These installation prompts, we already know, are inherently confusing for most users, especially when users encounter them in unexpected circumstances (see my submission to the FTC last April for an extended discussion of this issue: »netfiles.uiuc.edu/ehowes/www/dbd-anatomy.htm ). Indeed, the whole purpose of the XP SP2 security enhancements was to improve Internet Explorer's handling of ActiveX installations and thus make the automated installation of software online less confusing for regular users. If users misunderstand what they are being asked to install, they could wind up consenting to the installation of unwanted spyware and adware.
As others have observed, many users will not be running Windows XP SP2 and thus will not enjoy the enhanced protections offered in that service pack. They may be running Windows XP without SP2, or they may even be running earlier versions of Windows. In such cases, users will also encounter standard ActiveX installation prompts, making these Windows Media Player adware installations as confusing and deceptive as the automated installations of spyware and adware that users already encounter at third-party web sites, as Ben Edelman stressed in his write-up.
Who's At Fault?
Some commentators have attempted to minimize the risks posed by this new method for installing spyware and adware, pointing out that with a fully patched version of Internet Explorer no software will be installed without users first being given notice in some form. Thus, these skeptics insist, users who consent to the installation of unwanted software through this process are themselves at fault for clicking through the installation prompts.
But just how clear are the installation prompts presented to users? How easy would it be for users to unwittingly consent to the installation of spyware and adware while attempting to play Windows Media Player files they had encountered on the Net or on a P2P file sharing network?
The answers to these key questions, I discovered, are quite disturbing. Taken in its entirety, the installation process that users will encounter when attempting to play these rogue Windows Media Player files is extremely baffling.
For starters, the installation prompts are presented in confusing circumstances, as most users would never expect that they could acquire spyware and adware simply by playing media files. Still worse, though, the several spyware and adware installation prompts are specifically designed to exploit this initial confusion and coerce users into falsely believing that the spyware and adware programs are license files or even security upgrades to Windows Media Player required to view the media files.
In sum, the installation process used by these Windows Media Player files is among the most deceptive installation processes I have ever encountered, and it is entirely understandable that users could unwittingly consent to the installation of an unbelievable load of spyware and adware.
To illustrate what many users will encounter on versions of Windows other than Windows XP SP2 and with versions of Windows Media Player prior to version 10, I tested the same Windows Media Player file used by Ben Edelman and Ed Bott on a PC with Windows 2000 SP4, Internet Explorer w/ SP1, and Windows Media Player 9. Attached to this post are four screenshots that are critical to understanding the confusion deliberately created by adware vendors through this Windows Media Player license acquisition and software installation process.
Confusion, Deception, & Coercion
When I attempted to play the Windows Media Player file (P2Pporn.wmv), I immediately encountered a prompt to install a "Security Upgrade" for Windows Media Player 9 (see the attached WMP901.JPG screenshot). This is, in fact, a legitimate Microsoft security file, as explained on the "Learn More" information page ( »www.microsoft.com/windows/window···yer.aspx ):
said by Microsoft:
Security Upgrade
Owners of secure content may also require you to upgrade some of the DRM components on your computer before accessing their content. When you attempt to play such content, Windows Media Player will notify you that a DRM Upgrade is required and then ask for your consent before the DRM Upgrade is downloaded (third party playback software may do the same). If you decline the upgrade, you will not be able to access content that requires the DRM Upgrade; however, you will still be able to access unprotected content and secure content that does not require the upgrade. If you accept the upgrade, Windows Media Player will connect to an Internet site operated by Microsoft and will send a unique identifier along with a Windows Media Player security file. This unique identifier does not contain any personal identifiable information. Microsoft will then replace the security file with a customized version of the file that contains your unique identifier. This increases the level of protection provided by DRM.
I clicked OK to allow the "security upgrade." It is important to note that even though this particular file was a legitimate Microsoft upgrade, it plays an important role in creating a potentially confusing set of expectations for users, who will encounter still more prompts to install software that is apparently required to play the media file.
Confusion...
After clicking through the "Security Upgrade" installation prompt I next encountered a box titled "License Acquisition" (see WMP902b.JPG). This was a special, hosted instance of Internet Explorer that displayed a web page from:
»www.protectedmedia.com/licensede···rial.asp
That "License Acquisition" box was quickly covered over, however, with an ActiveX Security Warning box prompting me to install software from "Ultra Web Host LLC" (see WMP903.JPG). This ActiveX installation was initiated by the same hosted instance of Internet Explorer that displayed the "License Acquisition" box. Indeed, many users would not even see the "License Acquisition" box because it is so quickly covered over. Moreover, they won't be able to return to that "License Acquisition" box (which contains a "Play" button) until they deal with the multiple ActiveX installation prompts.
The description for this software is not especially noteworthy. The ActiveX prompt box merely claims that "You Must Agree to Our Terms and Conditions," a claim that will be unsurprising to most users at this point. And the name of the company, "Ultra Web Host LLC," does nothing to suggest that anything is amiss -- strangely named companies are a dime a dozen on the Web.
Some might point out that users can click the "You Must Agree to Our Terms and Conditions" link to view the End User License Agreement (EULA), which opens in an Internet Explorer window ( »spidersearch.com/barterms.php ). Setting aside the fact that many users will not know enough to click the link, that EULA they will encounter is clearly inadequate in the disclosure it provides. The only noteworthy clause comes near the top:
said by SpiderSearch.com:
By downloading our Free Porn Software you agree to receive ads of adult nature.
As Ben Edelman has pointed out, this license is clearly insufficient because it fails to disclose the installation of third-party software, which is in fact what will happen. Moreover, because users who intentionally downloaded this file will do so with the expectation of viewing porn, the clause quoted above is not likely to be of concern -- viewing "adult content" would be the entire reason they are attempting to play the media file. Many users will click through this installation prompt, and the result will be the installation of unwanted spyware and adware that was nowhere disclosed in a proper fashon.
When I first encountered the installation prompt for the "Ultra Web Host LLC" software, however, I clicked "No," rejecting the installation. To my surprise, the same prompt box popped up again. Again I clicked "No."
...Deception...
I was then confronted with yet another Active installation prompt, this time for a "Required Media Player Version 9 Browser Update" from iDownload.com (see WMP905.JPG). This installation prompt is particularly deceptive because it is clearly designed to exploit user confusion over the installation of required software for playing media files in Windows Media Player.
It should now be plainly apparent that adware vendors have already started tailoring their installations to Microsoft's WMP license acquisition process in order to maximize user confusion, and this is a rather clever way to do it. Given that users have already clicked through one update for Windows Media Player, many if not most would assume this was simply more of the same. Few regular users are going to fully understand what all these installation prompts mean or how they are in fact crucially different from one another. And that's on top of the fact that they certainly wouldn't expect a media file to be installing adware and spyware in the first place. The iDownload.com install cleverly attempts to preserve the fiction and keep them in the dark.
As with the first ActiveX Security Warning box, users can click a link to view the EULA ( »toolbar.isearch.com/terms.html ). Although this EULA is more extensive in its disclosures, it is still inadequate. The EULA claims:
said by iDownload.com/iSearch.com:
2. Functionality - Software delivers advertising and various information and promotional messages to your computer screen while you view Internet web pages. iSearch is able to provide you with Software free of charge as a result of your agreement to download and use Software, and accept the advertising and promotional messages it delivers.
By installing the Software, you understand and agree that the Software may, without any further prior notice to you, automatically perform the following: display advertisements of advertisers who pay a fee to iSearch and/or it's partners, in the form of pop-up ads, pop-under ads, interstitials ads and various other ad formats, display links to and advertisements of related websites based on the information you view and the websites you visit; store non-personally identifiable statistics of the websites you have visited; redirect certain URLs including your browser default 404-error page to or through the Software; provide advertisements, links or information in response to search terms you use at third-party websites; provide search functionality or capabilities; automatically update the Software and install added features or functionality or additional software, including search clients and toolbars, conveniently without your input or interaction; install desktop icons and installation files; install software from iSearch affiliates; and install Third Party Software.
In addition, you further understand and agree, by installing the Software, that iSearch and/or the Software may, without any further prior notice to you, remove, disable or render inoperative other adware programs resident on your computer, which, in turn, may disable or render inoperative, other software resident on your computer, including software bundled with such adware, or have other adverse impacts on your computer.
Unlike the first EULA from SpiderSearch.com, this EULA does mention the installation of third-party software, though only in vague, general terms. It never discloses the names of particular software programs, never discloses what the specific functionality of those programs will be, and never discloses the peculiar privacy practices of those other software programs. As such, this EULA is entirely inadequate.
By this point most users would likely already have agreed to the installation of software, either from this iDownload.com installation prompt or the earlier "Ultra Web Host LLC" prompt.
As with the "Ultra Web Host LLC" prompt, I clicked "No," rejecting the installation. But that wasn't the end of -- not by a long shot.
...Coercion...
After refusing the "Required Media Player Version 9 Browser Update" I had to refuse a good number more installs as well: both the SpiderSearch and the iDownload.com boxes popped up repeatedly, insistently. I also got one for the GAIN DashBar (again, refused). And then the regular Internet Explorer pop-ups started, with advertisements for porn, free gifts, and (what else?) dodgy anti-spyware applications like Spyware Stormer quickly filling my screen. Of course, attempting to close these pop-up ads simply spawned still more of them.
In the face of these repeated, insistent, confusing, and deceptive pop-ups, many if not most users would simply cave at some point, figuring the installs were necessary to view the media files, especially since the boxes kept popping up. And even though the media file will play if you refuse all the installations, users simply won't know that in advance (and you can't click the "Play" button in the original "License Acquisition" box until you dismiss the ActiveX installation prompts). All they'll know is that they've encountered a persistent, repeated set of prompts to install software that appears to be required to view the file -- just like the first WMP "Security Upgrade" they encountered from Microsoft.
...and then Submission
After refusing several more installation prompts I finally clicked through the "Ultra Web Host LLC" installation prompt, which had appeared numerous times at this point.
My test PC was quickly deluged with spyware and adware, but I still wasn't through yet. The iDownload.com "Required Media Player Version 9 Browser Update" installation prompt returned and I clicked through that as well, bringing still more spyware and adware down onto my system on top of the burdensome load already inflicted on the PC (which is a 1.8 Ghz Pentium 4 w/ 512 mb RAM and an ATI RadeOn video card). Although the "License Acquisition" box finally returned, allowing me to actually play the video file, shortly thereafter my PC ground to a stop, completely overrun with spyware and adware.
Ben Edelman reports the installation of 31 programs in 58 folders, 786 files, and 11,915 registry entries on his test PC. My own count was roughly the same, making this one of the more abusive adware/spyware installations I have ever encountered. In an earlier post here at DSLR, Suzi of Spyware Warrior reported a similar experience ( »Adware Installed through WMA Files ):
said by Suzi:
I installed the same WMA file on an old Win ME box with no protection except AVG free and the free version of Zone Alarm. I ended up with 11 desktop shortcuts for everything from "Get This Weeks Deals from Dell" to "Get Sex Toys Direct", "Hot Facial xxx Shots", and so on. Not to mention all the other crapware. None of them had EULA's except for the GAIN dash bar. That machine was infected faster than you could take a couple of deep breaths.
It took me nearly 2 hours to clean it up and I know what I'm doing. Image the "normal" user who doesn't have a clue. The computer becomes essentially useless until it's cleaned up.
My own experience cleaning up the mess was close to Suzi's. Most users would likely throw in the towel and opt for a complete format and re-install.
Security for Whom?
There is one other aspect of this situation that is rather irksome: the WMP "Security Upgrade" from Microsoft, which is required to view DRM protected media content. Both the pop-up box and the "Learn More" IE window -- which opens if you click for more info -- use the words "security" and "secure content" over and over again, yet the use of those terms is a bit slippery in this context.
Most of the time when you encounter "security upgrades" and what-not, the security that's being enhanced is your own. Your computer is upgraded to provide better protection to you from outsiders on the Internet.
Not so with this "security upgrade." This "security upgrade" is designed to protect copyright holders from YOU, because it is YOU who represent a threat to THEM -- YOU with your thieving, pirating, "fair use" exploiting ways.
I really have to wonder how many users will see all the talk of "security" and "secure content" without understanding who is really being protected from whom (and who is most certainly NOT being protected from whom).
If nothing else, this situation highlights Microsoft's poor implementation of DRM. Indeed, the truly cynical could now point out that the standard, illegal MP3 files that populate P2P networks are in some ways more secure than Microsoft's DRM-enabled WMA files. And that's a sad commentary on the industry's efforts to persuade consumers to accept "secure" DRM-enabled content.
Conclusion
Contrary to Ed Bott's assertion that this is not a "new and horrifying security risk" ( »Adware Installed through WMA Files ) the installation practices that users are forced to deal with when attempting to play these rogue Windows Media Player files are so confusing, deceptive, and coercive that regular users are at high risk for unwittingly consenting to the installation of spyware and adware, with potentially dire consequences for their computers, to say nothing of their privacy and security. The installation practices combine and exploit a dangerous combination of circumstances and qualities to bamboozle users into believing that they are consenting to the installation of software required to view media files. Among those circumstances and qualities are:
* a legitimate, required Windows Media Player "Security Upgrade" that conditions users to expect the installation of required software;
* ActiveX Security Warning boxes that users find inherently confusing because of the vague and inadequate information provided;
* ActiveX installation prompts for software deliberately named to give the impression that it is yet another required Windows Media Player upgrade;
* repeated, insistent pop-ups designed to coerce users into consenting to the installation of software;
* murky, confusing End User License Agreements that fail to disclose the installation of third-party software as well as the functionality and privacy practices of that software.
What we need from Microsoft is a swift fix for the problems summarized here, not attempts to minimize and pooh-pooh the risk or to subtly suggest that users are the problem for not upgrading to XP SP2 and for clicking through installation prompts. As I stressed in an earlier post here at DSLR, it is absolutely inexcusable that media files should have ever become a vehicle for pushing spyware and adware on unsuspecting users. Media files should simply not be a vehicle for adware installations. Period. That there are preventative measures for this unwelcome behavior and functionality is no excuse for the problem itself. It should have never existed in the first place.
Best,
Eric L. Howes | |
2 edits | Hi All:
I thought I'd provide a handy run-down of links to information on the WMP Adware story elsewhere on the web:
PC World stories:
»www.pcworld.com/news/article/0,a···6,00.asp
»www.pcworld.com/news/article/0,a···3,00.asp
DSLR discussion threads:
»Adware Installed through WMA Files
»WMP Adware: A Case Study in Deception
DSLR news topic:
»Spyware Hidden in WMA Files
Write-up by Ben Edelman:
»www.benedelman.org/news/010205-1.html
Write-ups by Ed Bott:
»www.edbott.com/weblog/archives/000334.html
»www.edbott.com/weblog/archives/000340.html
»www.edbott.com/weblog/archives/000341.html
»www.edbott.com/weblog/archives/000342.html
Spyware Warrior blog entries:
»netrn.net/spywareblog/archives/2···a-files/
»netrn.net/spywareblog/archives/2···a-files/
»netrn.net/spywareblog/archives/2···edelman/
Spyware Warrior discussion:
»spywarewarrior.com/viewtopic.php?t=8920
Other blog entries:
»techdirt.com/articles/20041230/0···_F.shtml
»www.boingboing.net/2004/12/30/wi···ici.html
»p2pnet.net/story/3421
Slashdot discussion:
»it.slashdot.org/article.pl?sid=0···2&tid=17
Best,
Eric L. Howes | |
 CudniLa Merma - VigiladoPremium,MVM
join:2003-12-20
Someshire
kudos:13 | reply to eburger68
Thank you for this fine fine report. It is as interesting as it would be scary for an ordinary user if faced with deluge of requests and popups (and most would succumb long before you did).
Add the desire to view the file, mix that with bona fide file from MS and user will think that anything after it is kosher.
Cudni
--
Whether you think that you can, or that you can't, you are usually right.
Help yourself so God can help you..it does exactly what it says on the sig | |
edbott
join:2005-01-02
Scottsdale, AZ | Excellent work, Eric.
Just for the record, I am not trying to minimize this. My statement that this is not "new and horrifying" simply reflects the reality that these are the exact same techniques that purveyors of crapware have been using from Web sites for years. The ActiveX dialog boxes you show here are identical in every respect to those that users see when they visit Web pages that push the same software. This is merely a new variation on an old theme.
The reason that spyware and viruses are epidemic is that older versions of Windows make it easy for people to push this crap, and as you correctly note, the confusing interfaces make it easy for naive users to be fooled by basic social engineering.
The bigger problem is finding a way to protect users of older Windows versions from agreeing to this stuff, regardless of where it comes from. If you fix the ActiveX problem in IE, you fix it here. It worked in Windows XP SP2, and there needs to be an equally effective way to make that protection work for users of older operating systems.
Ed Bott
»www.edbott.com/weblog | | |
|
edbott
join:2005-01-02
Scottsdale, AZ | Eric, have you reported your findings to Microsoft?
I have sent a report to security@microsoft.com. If you actually want a patch to get written, that's an important step. I'll let you know if I hear back. You might want to send your findings as well.
As I've said since Day One, I believe that this is a security flaw and that Microsoft needs to issue a patch to Windows Media Player 9 and release it as a Critical Update. That's a far cry from an "attempt to minimize and pooh-pooh the risk or to subtly suggest that users are the problem for not upgrading to XP SP2 and for clicking through installation prompts." | |
| reply to eburger68
Scary stuff, to be sure.
I've flat-out refused to install any of that DRM junk from the beginning. Looks like I have even more reason to do so now. | |
1 edit | reply to edbott
Ed:
You wrote:
said by edbott:As I've said since Day One, I believe that this is a security flaw and that Microsoft needs to issue a patch to Windows Media Player 9 and release it as a Critical Update. That's a far cry from an "attempt to minimize and pooh-pooh the risk or to subtly suggest that users are the problem for not upgrading to XP SP2 and for clicking through installation prompts." I'm glad that you agree that MS needs to patch this behavior, but your comments have not always been as clear and unambiguous as you have suggested. First, you tried to throw cold water on the story:
»www.edbott.com/weblog/archives/000334.html
Then when you had the sample file in hand, you spent most of your next blog entry explaining why this wasn't such a serious problem:
»www.edbott.com/weblog/archives/000340.html
A comment like this...
said by Ed Bott:
The programs in question are digitally signed and are from known companies. The terms of service make it clear what you're getting. It takes one click and 10 seconds of reading to realize that the correct answer is no.
...is so misguided one hardly knows where to begin. And it was only after Ben, Suzi, and Andrew protested that you began clarifying your remarks.
Even after explaining in your next blog entry that you weren't trying to blame the user ( »www.edbott.com/weblog/archives/000341.html ), you ended your denial with these odd quips:
said by Ed Bott:
But really, isn't that the real problem here? People running old operating systems, with only a dim awareness of the need to do updates and a willingness to install anything? ... But how likely is it that the type of user Suzi is describing will download and install that patch?
As for contacting Microsoft Security, to the best of my knowledge they are already aware of this problem.
Regards,
Eric L. Howes | |
edbott
join:2005-01-02
Scottsdale, AZ | I have a detailed response here:
»www.edbott.com/weblog/archives/000351.html
Quick summary:
My initial response was skeptical, and accurately so. The PC World article said, "PC World has learned that some Windows Media files on peer-to-peer networks such as Kazaa contain code that can spawn a string of pop-up ads and install adware." [emphasis added]. The clear implication was that simply playing a music or video file will install a program on your machine. That turned out not to be true, as you and I have both shown.
My remarks about digital signatures were not intended to justify the purveyors of this garbage or to imply that signed programs are somehow safe. My remarks were aimed at the readers of this forum and my Web site, who are already well informed about spyware and viruses and would be deeply suspicious of these dialog boxes. I was shocked at how honest the license agreements were in describing the crappy things these programs would do. I don't expect a sophisticated, suspicious user to be fooled by this stuff. I also don't expect a naive user to read license agreements ever.
As for "blaming the user," I stand by the remark I made. You are demanding that Microsoft patch this vulnerability. I agree that that should be done. But the reason that viruses and spyware spread is because no matter how hard we try to educate the masses, many people simply don't install patches after they're released. I get virus-infected e-mail messages every day, and my mail server blocks many more. In most cases those viruses can be prevented by a patch that were released three or four years ago. If someone hasn't installed a Critical Update from 2001, why would they install a new one to fix this vulnerability when it's available? | |
2 edits | Ed:
I'm happy to let readers peruse your several comments on this issue and make up their own minds as to whether they were appropriate or not.
There are, however, two minor points that you make that I want to repond to:
said by edbott:The clear implication was that simply playing a music or video file will install a program on your machine. That turned out not to be true, as you and I have both shown. That's one way to read that particular sentence from PC World. Another way is to read it is as literally as possible. Is the code contained in the WMP files *capable* of installing adware? Answer: yes. Now, assuming the user's IE is fully patched, the user's click-through is required, but that's a minor detail. PC World certainly could have qualified that statement just a bit, but strictly speaking what PC World wrote was correct.
said by edbott:I was shocked at how honest the license agreements were in describing the crappy things these programs would do. But, Ed, they were *not* honest -- far from it. That's the whole point. I have seen spyware/adware EULAs that were scrupulously honest in the detail they provided about the software to be installed, but these two particular EULAs were not anywhere near that detailed, esp. the Ultra Web Host LLC EULA which said next to nothing. Failing to disclose the installation of 31 separate spyware/adware programs is the very definition of "unfair" and "deceptive" business practices.
Regards,
Eric L. Howes | |
edbott
join:2005-01-02
Scottsdale, AZ | I should have put "honest" in quotes. How many more ways do I have to say these people are sleazy scumbags?
The one license agreement says it will pop up porn ads on my computer. The other says it will do a whole paragraph's worth of awful things, including installing more spyware. I'm not sure which program is doing the installation of the 31 extras, because I didn't actually allow my test machine to be taken over.
And the fact that it was in the license agreement doesn't make it right or acceptable or "honest." My point is that someone who is suspicious will find plenty of reasons not to click Install; someone who is naive may well be fooled by the social engineering techniques. | |
| reply to eburger68
Quit looking at pr0n | |
| reply to edbott
Ed:
You wrote:
said by edbott:The one license agreement says it will pop up porn ads on my computer. The other says it will do a whole paragraph's worth of awful things, including installing more spyware. I'm not sure which program is doing the installation of the 31 extras, because I didn't actually allow my test machine to be taken over. It was the first one that installed most of the software in my testing, and that matches what Ben found as well.
The second one did install a few things, but not much beyond what was already there. I'm guessing that much of what it could have and would have installed independently was already installed by the time I clicked through the iDownload.com installation prompt.
Eric L. Howes | |
 TransmasterDon't Blame Me I Voted For Bill and Opus
join:2001-06-20
Cheyenne, WY | reply to SimpleOne
Wow 10 out of 10!!!! this is the kind of info' which keeps me coming back for all of these years. | |
 MagManLife is simpler when you tell the truth.Premium
join:2003-10-01
Westlake, OH | reply to eburger68
Nice info Thanks;) | |
edbott
join:2005-01-02
Scottsdale, AZ | reply to eburger68
I'm not the only one who interpreted the PC World story as meaning that the Windows Media files in question actually contained spyware code.
Techdirt wrote:
Overpeer, a subsidiary of Loudeye, has been caught hiding adware and spyware within Windows Media files. [emphasis in original] Boing Boing, which picked up the story from Techdirt, read it that way too:
According to PCWorld and TechDirt, Windows DRM contains a flaw that allows for attakcers [sic] to create music files that contain trojans that attack your computer when you play them. [emphasis added] My original post was skeptical about both of these reports, which were posted on very high traffic Web sites (Boing Boing is insanely popular, with more than 200,000 unique visitors a day and countless RSS subscribers). It turns out my skepticism was justified.
These "poisoned" files don't contain spyware. Rather, they use a DRM mechanism to open a dialog box that hosts a Web page that can try to fool a user into installing hostile software. That's not good, and the techniques used to push the crapware contained on those Web pages are sleazy. But the files themselves do not contain any hostile code, and the user has to be tricked into cooperating before anything gets installed. That's a far cry from what was in the three original and sensationalist stories.
There are no corrections at any of those three sites, by the way. So what the average user thinks is "the Internet is riddled with WMA files that contain viruses and trojan horses and spyware." Even though that simply isn't true. | |
 SYNACKJust Firewall ItPremium,Mod
join:2001-03-05
Venice, CA
Networking
Virtual Private Ne..
Netgear
ZyXEL
| reply to eburger68
Thanks for the detailed analysis. Scary stuff.
Hopefully, the new California Spyware law can slow them a bit.
said by suzi:
I ended up with 11 desktop shortcuts for everything from "Get This Weeks Deals from Dell" to ...
Any good anti-spyware law also needs to go after the companies that advertise via spyware. | |
| reply to edbott
Ed:
You wrote:
said by edbott:My original post was skeptical about both of these reports, which were posted on very high traffic Web sites (Boing Boing is insanely popular, with more than 200,000 unique visitors a day and countless RSS subscribers). It turns out my skepticism was justified. Fair enough. The Techdirt and Boing-Boing stories were not the best. Indeed, that's the kind of careless/clueless reportage that would have gone on no matter what PC World had written. The real story here is rather involved and difficult to understand, and Techdirt and Boing-Boing predictably made a hash of it. I see that all the time with spyware/adware issues, which are inherently confusing.
The PC World story, on the other hand, was well done for the most part. I just re-read it, and for the complexity of the issues covered, it does a respectable job of conveying the essentials. Here and there I might prefer a slightly different choice of words, but it's pretty close to what we understand now. Certainly nothing in there is outright false.
Just for the record, PC World was the first out with the word on this story. I wrote about it here at DSLR in the other discussion thread on this topic. DSLR/BBR news then picked it up, pointing both to the PC World story and the Security forum discussion thread. Techdirt got it from BBR/DSLR news, and Boing-Boing from Techdirt. In retrospect, it all looks like a high-tech game of "telephone."
Eric L. Howes | |
edbott
join:2005-01-02
Scottsdale, AZ | >> In retrospect, it all looks like a high-tech game of "telephone." Exactly, and that was my point in my original post. I certainly wasn't trying to "throw cold water" on the story, and please note that as soon as I heard that a sample file existed I contacted you to get a copy so I could do my own tests.
I do wish the larger sites would pick up on the real story, which is important and which people like you and Ben and Andrew and Suzi and me have dug out the hard way. But I guess that isn't sexy enough. | |
1 edit | reply to eburger68
Maybe you all have seen something similar from WMP. I posted the following to grc.spyware on 12/4/2004 and repost for the purposes of reiteration and experience sharing. And as one who has noticed some strange activity from WMP even when playing files I created with my own video camera I wanted to see who else experienced this. This is getting so that even one with fifteen years in the “industry” can’t tell what the hell is going on. I sometimes want to move to an isolated island with only Margarita serving me Margaritas!
#[include]
What is Microsoft Windows Media Player (v.10) doing pinging all
of these sites every time I open a local video file? All I did
was open a local file and then I noticed that the Firewall log
would burst with the lines seen below.
Why is WMP pinging these sites every time I open a local video
file (even if it is one I shot myself not that it matters)?
What exactly is being transmitted and received?
Why is the details of this not in the help files?
Behavior seems the same every time: I open the .WMV or .AVI
file which auto launches Microsoft Windows Media Player.
I could not make out what was in the data traffic I reviewed in the capture file from the packet sniffer (netmon)
I am not a spring-chicken here either. I’ve been a computer
tech and network admin for many years, and I remember when there
was just UUCP. I also currently perform basic network and system
security at my day job, so my curiosity is doubled. I saw this on
my home system can only fret what is going on in the corporate
network.
Enquiring minds just want to know.
Firewall Log Sample for the few seconds in which I started one local .WMV or .AVI file....
2004/12/04 20:46:02 TCP from 192.168.1.10:2321 to www.go.microsoft.akadns.net (207.46.248.122):80
2004/12/04 20:46:02 TCP from 192.168.1.10:2322 to entimg-origin.msn.com (207.68.181.118):80
2004/12/04 20:46:02 TCP from 192.168.1.10:2324 to locator.metadata.windowsmedia.com.akadns.net(207.46.196.121):80
2004/12/04 20:46:02 TCP from 192.168.1.10:2325 to www.go.microsoft.akadns.net (207.46.248.122):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2326 to sms.napster.com (63.241.55.113):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2327 to cinemanow.com (147.208.188.228):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2328 to 63.236.14.35 (63.236.14.35):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2329 to downloads.walmart.com (161.170.254.27):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2330 to www.xmradio.com (216.251.231.128):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2331 to courttv.com (209.73.26.183):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2332 to 209.133.113.22 (209.133.113.22):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2333 to moontax.vo.llnwd.net (69.28.159.7):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2334 to 63.240.84.86 (63.240.84.86):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2335 to a1321.cb.akamai.net (66.93.87.72):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2336 to music.msn.com (207.68.180.245):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2337 to downloads.walmart.com (161.170.254.27):80 | |
edbott
join:2005-01-02
Scottsdale, AZ | Those are the online stores available with WMP 10, music and video and radio. If you choose View, Online Stores you will see virtually all of the companies on that list. | |
|
