DeepSec 2010: Malware goes to the Movies

Thanks to the DeepSec organisation for making these videos available and let me share the videos on YouTube.

Speaker: Dr. Aleksandr Yampolskiy, Gilt Groupe

As the criminals adapt, they look for new ways to distribute malware. This talk will examine new types of malware that spread through online videos, music files, and images. We begin by analyzing media malware trends, and discover that many of the attacks are not targetted and that they are usually reliant on social engineering and blackhat search engine optimization. Next, we provide a taxonomy of different attack vectors. We show that music and video files are commonly infected via URLANDEXIT script injection or DRM licensing abuse, where a user is tricked into downloading a malware posing as a --fake codec--. We analyze a growing trend of fake Youtube sites, covering the latest news events. These sites are often advertised through social networking sites, such as Facebook. We demonstrate how easy it is to set up such sites, via a YTFakeCreator toolkit. We then discuss how images of Angelina Jolie have been used to exploit JPEG GDI buffer overflow vulnerability in the past, and how it's still prevalent nowadays. Finally, we discuss some protection mechanisms, ranging from OS configuration changes to disable URLANDEXIT commands, to a custom tool (that will be open-sourced after the talk), which can help easily detect the malware before downloading the entire video. Our tool uses some innovative ideas, such as sequential downloads of the media file, and entropy analysis to detect injected script commands.

For more information visit: http://bit.ly/DeepSec_2010_information
To download the video visit: http://bit.ly/DeepSec_2010_videos

Category:

Science & Technology

Tags:

• DeepSec
• 2010
• Security
• Conference
• Europe
• Web
• Applications
• Attacks
• Techniques
• Vulnerabilities
• Research
• Presentation
• malware
• media
• video
• audio
• trojan
• software

[ChRiStIaAn008]

@GammahooX was indeed a good presentation, interesting you can hide a virus easily in .asf and the wmv drm verification easy to let a user download a virus

[GammahooX]

"66% percent of the movies were now clean but still 44% were infected."

Ouch! Well the presentation is still very good tho. :)