full-disclosure - Re: security notice: Backdooring Windows Media Files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B4F529047A581D48A7D52F9C451CE4A9031F7F9A@rivendell.cc.vt.edu>
Date: Tue, 18 Sep 2007 14:56:34 -0400
From: "Memisyazici, Aras" <arasm@...edu>
To: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: security notice: Backdooring Windows Media
	Files

Hi pdp!

Great admirer of your work :) I just wanted to inform you that I have
tested your claim, on a fully patched/updated Win XP SP2 system with an
admin account logged in, and was warned sufficiently(asked whether I
wanted to play asx files, then asked if I was sure by Media Player, then
pop-up was blocked by IE), while the page you tried to produce was
blocked via IE's pop-up blocker.

You can see/confirm this by viewing these screenshots:

http://preview.tinyurl.com/34xpcz
(http://i189.photobucket.com/albums/z159/vtknightmare/noworkie1.png )

and

http://preview.tinyurl.com/34jx5v
(http://i189.photobucket.com/albums/z159/vtknightmare/noworkie2.png )

This was tested on a plain/manila/vanilla version of XP SP2. All I did
was update/upgrade to latest available from M$ Update.

Sincerely,
Aras Memisyazici
IT/Security/Dev. Specialist

Outreach Information Services
Virginia Tech

-----Original Message-----
From: pdp (architect) [mailto:pdp.gnucitizen@...glemail.com] 
Sent: Tuesday, September 18, 2007 11:58 AM
To: bugtraq@...urityfocus.com; full-disclosure@...ts.grok.org.uk
Subject: security notice: Backdooring Windows Media Files

http://www.gnucitizen.org/blog/backdooring-windows-media-files

It is very easy to put some HTML inside files supported by Window
Media Player. The interesting thing is that these HTML pages run in
less restrictive IE environment. I found that a fully patched windows
XP SP2 with IE6 or IE7 and Windows Media Player 9 (default) will open
any page of your choice in IE even if your default browser is Firefox,
Opera or anything else you have in place. It means that even if you
are running Firefox and you think that you are secure, by simply
opening a media file, you expose yourself to all IE vulnerabilities
there might be. Plus, attackers can perform very very interesting
phishing attacks. I prepared a simple POC which spawns a browser
window in full screen mode... Think about how easy it is going to be
to fake the windows logout - login sequence and phish unaware users'
credentials

http://www.gnucitizen.org/projects/backdooring-windows-media-files/poc02
.asx

On the other hand Media Player 11 (Vista by default) is not exposed to
these attacks.

-- 
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/