The Register® — Biting the hand that feeds IT

Feeds

Rogue MP3 Trojan streaks across P2P networks

Hundreds of thousands of examples of a new Trojan that poses as a media file have flooded onto P2P networks. Since Friday 2 May more than half a million instances of the Trojan have been detected on consumer PCs, according to net security firm McAfee. The anti-virus firm reports the spread of the Downloader-UA.h Trojan as the …

This topic is closed for new posts.

Page:

DRM?

I have a vague feeling that DRM is to blame to the success of this outbreak. DRM sometimes requires an application to run alongside that mp3 to authorize the computer and/or decode the mp3, people have come accustomed to running said applications to play the mp3s. Most of these people who run this 'exe' file are not technically inclined and don't know when to draw the line between DRM and a virus nowadays.

We now have a situation where people no longer CAN know the difference if an MP3 will play without this exe because of what the studios and corporates with their own DRM have caused.

Soon enough if DRM is allowed to continue going out of control like this, we will get situations where nobody, not even the IT people will know when some "DRM player", "DRM system authorizer", etc is really a virus. Refer to the Sony rootkit incident for example, people didn't know that sony was installing something akin or worse(?) than a virus with this system until it was months into the situation.

Do we really know what Windows Media player does behind the scenes nowadays? Do we really know what iTunes/Quicktime does behind the scenes nowadays? Do we really know what ANY DRM-enabled player does behind the scenes nowadays? I wager not, and of course, the source code cannot be released for review due to the fact corporates forbid it as it would release their "trade secrets", which there are laws protecting.

Until DRM is totally eliminated, this problem will just escalate.

Pirate

I call MP3's and videos...

...on my hard disks 'Time Shifting' which is perfectly legal :)

Unhappy

@ Dick Emery (time shifting)

VERY clever. Shame on me. I should have thought of that before. I doubt it will stop the MPAA's or RIAA's lawyers though. They have more money than you have, and in the US judiciary system it means that they're right, and you're wrong.

Warnings! Listening to MP3's is illegal!

If you or anybody you know are listeing to this mp3 then you are breaking the law! Stop the player immediately, kneel down with your hands on your head and await the authorities! MUSIC PIRACY IS A CRIME!

Paris Hilton

Piracy is theft, murder, rape and kiddy fiddling

and yet I carry on and don't give a crap. While I'll never have time to go through all the 150gb of MP3s that I've downloaded, I've never come across one infected with a virus or spoiled in some other way.

@Michael C - it's good for a man to know his limitations, and obviously coping with the technicalities of bittorrent downloading is one of yours. I'd like to thank you for sponsoring the music industry so that I can carry on enjoying unlimited music and software for free.

Paris because she probably knows a thing or two about nasty viruses.

Happy

another for Mikey C!

hey mike, just had to throw in my tuppence worth on that crock you wrote. most points have already been addressed, but the last paragraph is something i have to come back on...

"To all you kiddies out there that por through torrents to get all the free stuff you can"

well i download a fair bit of stuff from torrents but i ain't a kiddie, either from the perspective of age or technical knowledge...

"first of all sooner or later you're going to get nailed by a virus like this or worse"

as a professional reverse engineer and malware researcher i doubt this is gonna happen... but thanks for your concern

"second, you'll ned up starting all over from scratch regularly since likely you have no backup for your hundreds of GBs of data..."

again cheers for the kind thoughts, but you'll be relieved to know that i have a very thorough system of backups across my machines that ensure that i have at least two and even sometimes three copies of all my data! including all my music and films:o)

Anonymous Coward
Anonymous Coward

Plenty of free legal stuff

Plenty of free, legal music out there ripe for the downloading. Some of it's even pretty good.

For example try

http://remix.kwed.org/?view=rating

Anonymous Coward
Anonymous Coward

what innovative ecosystem ..

What innovative ecosystem does this Trojan run on?

Happy

crapmadona.mp3.trojan.exe

jebus told me crapmadona.mp3.trojan.exe would start the rapture and save the world (well the god squaders anyway, who cares about normal people) pwaise the lard!!!

Anonymous Coward
Anonymous Coward

Redundant Arrays

Re: And to whomever said hard drives couldn't be backed up... Magnetic storage is quite cheap, and they make these things called Redundant Arrays...

No, you don't use redundant arrays for backups!

RAID arrays are used for fault tolerance. Backups should be held on a different storage devices, not the RAID array.

The issue is if the RAID array becomes infected, or somebody deletes files, then all hard drives in the array will be affected.

Pirate

@How it works... I reported this vuln 6 years ago.

They're called "URL flips".

http://seclists.org/bugtraq/2002/Feb/0327.html

Anonymous Coward
Coat

guilt

funny thing this guilt.

no matter what one does some politically correct anal representitive will say that it is illigal or amoral and will try to pass some screwy law to screw the majority that does not like them in first place... so by this defenition alone we are all guilty. the entertainment industry gestapo screams at us and prosecutes us for listening to music or for watching movies that they produce. goverment screams threatens us for not paying taxes for which they spent like there is no tomorow on worthless crap that no one really needs except for neccesary basics. churches or religious zelots threaten cajole along with screaming at us for not being moral enough by their so called standards(i wonder if goat/sheep sacrifice at midnight counts as an amoral while praying to l ron hubbard ?). i know i missed a few add more if you want.but unfortunetly i have no guilt complex whatsover when it comes to ripping music watching what i want annoy government when possible and piss off any and all religious nutters for my personal enjoyment( some of them have very funny looks when you go against them my fav is when they start ot twitch and foam at the mouth). i do all that so i can annoy these so called politicaly correct anal cavaties with small brains and big multiple orafices that spew crap over everything in range with ever higher efficiency. any how that is my two cents...

i read the blog it seems to be a pre eliminary evaluation as to what it does.we will know soon enough all the details as with everything it will take time and some skull work( some of us seem to forget that part). so critisizing it for being in lacking info is just saying i am a rotten kid and cannot wait for that candy gimmie gimmie gimme or i will throw a tantrum.(if you cannot wait do the work yourself)

as for comment about registered p2p usually kill infected uploads its load of rubbish. i personally had seen files that had been infested with malware, trojans, viruses sit there on trackers for months or longer even after they had been flagged.

as for the comments from both macs linux windows users keep this in mind no matter what os or kit you are using it will be exploited at some point no matter what you say or do even if you follow strict or very strict use policies you are not invincible you are not god/s.

Anonymous Coward
Stop

Freetards?

You see I think that it wold be fairer to say that the retards are having a bad day. The Free bit has little to do with it in this case, IMO.

If you can't tell an executable from an MP3 then what do you expect? If you fall for that then you'd probably open a dodgy file if it was emailed to you, or whatever.

Paris Hilton

BBC are reporting

That the file poses as a girls aloud [no they shouldn't be] song,

If you like that crap you deserve anything you get!

Paris, cos she knows all about releasing any old shyite for money.

Page:

This topic is closed for new posts.