security notice: Backdooring Windows Media Files Sep 18 2007 03:57PM
pdp (architect) (pdp gnucitizen googlemail com) (2 replies)
http://www.gnucitizen.org/blog/backdooring-windows-media-files

It is very easy to put some HTML inside files supported by Window
Media Player. The interesting thing is that these HTML pages run in
less restrictive IE environment. I found that a fully patched windows
XP SP2 with IE6 or IE7 and Windows Media Player 9 (default) will open
any page of your choice in IE even if your default browser is Firefox,
Opera or anything else you have in place. It means that even if you
are running Firefox and you think that you are secure, by simply
opening a media file, you expose yourself to all IE vulnerabilities
there might be. Plus, attackers can perform very very interesting
phishing attacks. I prepared a simple POC which spawns a browser
window in full screen mode... Think about how easy it is going to be
to fake the windows logout - login sequence and phish unaware users'
credentials

http://www.gnucitizen.org/projects/backdooring-windows-media-files/poc02
.asx

On the other hand Media Player 11 (Vista by default) is not exposed to
these attacks.

--
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

[ reply ]
Re: security notice: Backdooring Windows Media Files Sep 18 2007 11:45PM
jf (jf danglingpointers net)
RE: security notice: Backdooring Windows Media Files Sep 18 2007 06:56PM
Memisyazici, Aras (arasm vt edu) (1 replies)
Re: security notice: Backdooring Windows Media Files Sep 18 2007 07:00PM
pdp (architect) (pdp gnucitizen googlemail com) (1 replies)
RE: security notice: Backdooring Windows Media Files Sep 18 2007 07:08PM
Memisyazici, Aras (arasm vt edu)


 

Privacy Statement
Copyright 2010, SecurityFocus