DOWNLOAD: Best tool to repair Windows problems & optimize system performance | Best driver update software for your PC
 
Results 1 to 2 of 2

Thread: Audio files downloaded from file-sharing websites can actually set you up

  1. #1
    riteshtechie's Avatar
    riteshtechie is offline Software Developer
    Join Date
    Mar 2009
    Posts
    880

    Default Audio files downloaded from file-sharing websites can actually set you up

    On the 15th of October, the BitDefender labs came across four critical vulnerabilities affecting Winamp 5.x. Shortly thereafter, several exploits piggybacking on these vulnerabilities were spotted in the wild. We won’t go into detail about the first three, as they basically need no user interaction beyond loading them into the playlist, so here’s a short run of the fourth one.



    Weapon

    The “weapon” used by the cyber-criminals is a malformed MTM file – an audio file format similar to the MOD and MIDI file – distributed to different potential victims as e-mail attachments, or through social networking or peer-to-peer file sharing. Its purpose is to lure computer users into downloading and adding it to their playlist.

    However from this point on, a little bit of social engineering is in demand since, in order for the exploit to trigger its payload, it is mandatory for the user to view the file info in Winamp. This is the action that sets the exploit contained inside the malformed MTM file into motion.

    Long story short


    As soon as the user views the file information, the exploit will initialize a backdoor service running on port 4444 and it will be ready to take connections from the outer world. The backdoor will be consequently used by an ill-intentioned person to easily gain remote access to your computer with the same privileges as the user running Winamp.

    Here’s a short video demonstrating how a connection becomes possible on port 4444 after the user has viewed the file info.

  2. #2
    hackerman1 is offline Senior Member
    Join Date
    Dec 2008
    Location
    Sweden
    Posts
    1,525

    Default

    hi !

    thanks for the info !

    this is one very good reason to set your firewall to block all incoming connections, and to always run the computer on a USER-account.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22