Comments on: Backdooring QuickTime Movies /blog/backdooring-quicktime-movies/ Information Security Think Tank Thu, 21 Aug 2008 19:30:47 +0000 http://wordpress.org/?v=2.6.1 By: Andre /blog/backdooring-quicktime-movies/#comment-72355 Andre Sat, 17 Nov 2007 23:21:05 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-72355 vbx i am interesting that too.. popup on preview movie its very interesting.. vbx i am interesting that too.. popup on preview movie its very interesting..

]]> By: vbx /blog/backdooring-quicktime-movies/#comment-65432 vbx Mon, 05 Nov 2007 16:20:34 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-65432 would like to know if is possible to create the popup alter when the movie is previewed inside a standalone QuickTime player. would like to know if is possible to create the popup alter when the movie is previewed inside a standalone QuickTime player.

]]> By: Quicktime and Firefox vulnerability - Spyware Sucks /blog/backdooring-quicktime-movies/#comment-48926 Quicktime and Firefox vulnerability - Spyware Sucks Thu, 13 Sep 2007 23:59:51 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-48926 [...] on, I have to say a few things. Last year I disclosed two highly critical QuickTime vulnerabilities here and here. The first vulnerability was fixed but the second one was completely ignored. I tried to [...] [...] on, I have to say a few things. Last year I disclosed two highly critical QuickTime vulnerabilities here and here. The first vulnerability was fixed but the second one was completely ignored. I tried to [...]

]]> By: Ryan Naraine’s Zero Day mobile edition /blog/backdooring-quicktime-movies/#comment-48374 Ryan Naraine’s Zero Day mobile edition Wed, 12 Sep 2007 17:10:26 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-48374 [...] (left) released details on vulnerabilities in Apple’s QuickTime media player to show how movie and .mp3 files can be backdoored to hack into [...] [...] (left) released details on vulnerabilities in Apple’s QuickTime media player to show how movie and .mp3 files can be backdoored to hack into [...]

]]> By: 0DAY: QuickTime pwns Firefox | GNUCITIZEN /blog/backdooring-quicktime-movies/#comment-48301 0DAY: QuickTime pwns Firefox | GNUCITIZEN Wed, 12 Sep 2007 12:06:02 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-48301 [...] on, I have to say a few things. Last year I disclosed two highly critical QuickTime vulnerabilities here and here. The first vulnerability was fixed but the second one was completely ignored. I tried to [...] [...] on, I have to say a few things. Last year I disclosed two highly critical QuickTime vulnerabilities here and here. The first vulnerability was fixed but the second one was completely ignored. I tried to [...]

]]> By: roger /blog/backdooring-quicktime-movies/#comment-46172 roger Wed, 05 Sep 2007 18:27:37 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-46172 yea i need this to work yea i need this to work

]]> By: Doc /blog/backdooring-quicktime-movies/#comment-44854 Doc Sat, 01 Sep 2007 00:52:17 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-44854 Quote [dodgescabin responds: I never use quicktime its not very good] ??? What the f***? - Is that the dumbest sweeping statement ever? It's like saying cars are not very good - or the sky is not very good! Quote [dodgescabin responds: I never use quicktime its not very good] ???

What the f***? - Is that the dumbest sweeping statement ever? It’s like saying cars are not very good - or the sky is not very good!

]]> By: dodgescabin /blog/backdooring-quicktime-movies/#comment-44485 dodgescabin Thu, 30 Aug 2007 18:37:32 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-44485 I never use quicktime its not very good I never use quicktime its not very good

]]> By: pdp /blog/backdooring-quicktime-movies/#comment-27653 pdp Thu, 07 Jun 2007 19:09:50 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-27653 yes... this is right... and this is how it should be yes… this is right… and this is how it should be

]]> By: Runic /blog/backdooring-quicktime-movies/#comment-27589 Runic Thu, 07 Jun 2007 15:20:19 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-27589 Starting with QuickTime 7.1.5, you can no longer issue javascript:// URLs or call JavaScript functions from within a QuickTime movie. This feature was removed from QuickTime for security reasons. Starting with QuickTime 7.1.5, you can no longer issue javascript:// URLs or call JavaScript functions from within a QuickTime movie. This feature was removed from QuickTime for security reasons.

]]> By: sasha /blog/backdooring-quicktime-movies/#comment-19742 sasha Fri, 04 May 2007 19:01:42 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-19742 How can you get around websense to get to myspace How can you get around websense to get to myspace

]]> By: Cityboi /blog/backdooring-quicktime-movies/#comment-16717 Cityboi Wed, 25 Apr 2007 13:34:11 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-16717 How can you get around websense to get to myspace How can you get around websense to get to myspace

]]> By: PandaLabs Blog : Insecure features : should AV companies detect them? /blog/backdooring-quicktime-movies/#comment-8356 PandaLabs Blog : Insecure features : should AV companies detect them? Tue, 20 Mar 2007 15:46:36 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-8356 [...] Insecure features : should AV companies detect them? These days we have been analyzing one of the latest MySpace threats, JS/MySpace.A, which uses an interesting QuickTime feature : HREF Tracks. A deep analysis of this malware is avaliable at Didier Steven´s blog. Abusing HREF Tracks was firstly documented by pdp at GNUCITIZEN blog, later the MoAB project showed how to exploit them in conjunction with other vulnerabilities that allowed hackers to gain remote code execution. The end of the story is as follows: Apple has finally removed javascript support in QuickTime from version 7.1.5. But that´s not the end of it, I still remember a very similar case in which a feature became a vulnerability and we ended up adding generic detections for a legal and documented use of WMF file format, though I don't think anybody was really using it. So I wonder and I ask you: Should we add generic detections to file formats that support insecure features? If we do so, we may stop malware, but what can we say to a hypothetical customer using them properly? Published Tuesday, March 20, 2007 1:39 PM by mballano _uacct = "UA-969620-1"; urchinTracker(); _uacct = "UA-1443584-1"; urchinTracker(); [...] [...] Insecure features : should AV companies detect them? These days we have been analyzing one of the latest MySpace threats, JS/MySpace.A, which uses an interesting QuickTime feature : HREF Tracks. A deep analysis of this malware is avaliable at Didier Steven´s blog. Abusing HREF Tracks was firstly documented by pdp at GNUCITIZEN blog, later the MoAB project showed how to exploit them in conjunction with other vulnerabilities that allowed hackers to gain remote code execution. The end of the story is as follows: Apple has finally removed javascript support in QuickTime from version 7.1.5. But that´s not the end of it, I still remember a very similar case in which a feature became a vulnerability and we ended up adding generic detections for a legal and documented use of WMF file format, though I don’t think anybody was really using it. So I wonder and I ask you: Should we add generic detections to file formats that support insecure features? If we do so, we may stop malware, but what can we say to a hypothetical customer using them properly? Published Tuesday, March 20, 2007 1:39 PM by mballano _uacct = “UA-969620-1″; urchinTracker(); _uacct = “UA-1443584-1″; urchinTracker(); [...]

]]> By: Chris Mosby at myITforum.com : McAfee Avert Labs Blog - MySpace Woes: Trojan Targets French Rock Band Fans - Friday March 16, 2007 /blog/backdooring-quicktime-movies/#comment-8059 Chris Mosby at myITforum.com : McAfee Avert Labs Blog - MySpace Woes: Trojan Targets French Rock Band Fans - Friday March 16, 2007 Mon, 19 Mar 2007 16:13:53 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-8059 [...] And the latest target is unsuspecting fans of the French rock band MAMASAID who upon visiting a MySpace account promoting the music group get a trojan JS/SpaceStalk installed on their computers via a known insecure feature in QuickTime called HREF Tracks. The technique used here does not rely on vulnerability but rather on a feature present in the QuickTime player that allows for links to be opened automatically when the movie is run. This link could be misused to point to malicious websites hosting exploit code. [...] [...] And the latest target is unsuspecting fans of the French rock band MAMASAID who upon visiting a MySpace account promoting the music group get a trojan JS/SpaceStalk installed on their computers via a known insecure feature in QuickTime called HREF Tracks. The technique used here does not rely on vulnerability but rather on a feature present in the QuickTime player that allows for links to be opened automatically when the movie is run. This link could be misused to point to malicious websites hosting exploit code. [...]

]]> By: lastjedi /blog/backdooring-quicktime-movies/#comment-7850 lastjedi Mon, 19 Mar 2007 02:54:43 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-7850 i have quicktime pro and vlc media player none work on limewire.when i download a video to watch i get the same thing a girl dancing for about 10 seconds nothing else.ive downloaded hundreds of videos and i get the same thing the girl dancing.why wont it show the video i downloaded.nothing works please help! i have quicktime pro and vlc media player none work on limewire.when i download a video to watch i get the same thing a girl dancing for about 10 seconds nothing else.ive downloaded hundreds of videos and i get the same thing the girl dancing.why wont it show the video i downloaded.nothing works please help!

]]> By: Windows Vista /blog/backdooring-quicktime-movies/#comment-7190 Windows Vista Sat, 17 Mar 2007 03:02:14 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-7190 neat neat

]]> By: Computer Security Research - McAfee Avert Labs Blog /blog/backdooring-quicktime-movies/#comment-7048 Computer Security Research - McAfee Avert Labs Blog Fri, 16 Mar 2007 17:24:23 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-7048 [...] And the latest target is unsuspecting fans of the French rock band MAMASAID who upon visiting a MySpace account promoting the music group get a trojan JS/SpaceStalk installed on their computers via a known insecure feature in QuickTime called HREF Tracks. The technique used here does not rely on vulnerability but rather on a feature present in the QuickTime player that allows for links to be opened automatically when the movie is run. This link could be misused to point to malicious websites hosting exploit code. [...] [...] And the latest target is unsuspecting fans of the French rock band MAMASAID who upon visiting a MySpace account promoting the music group get a trojan JS/SpaceStalk installed on their computers via a known insecure feature in QuickTime called HREF Tracks. The technique used here does not rely on vulnerability but rather on a feature present in the QuickTime player that allows for links to be opened automatically when the movie is run. This link could be misused to point to malicious websites hosting exploit code. [...]

]]> By: average admins » Blog Archive » P0wned by a QT movie /blog/backdooring-quicktime-movies/#comment-6697 average admins » Blog Archive » P0wned by a QT movie Mon, 12 Mar 2007 21:07:41 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-6697 [...] Embedding JavaScript inside a Quicktime movie is nothing new as GNUCitizen discussed back in September but it’s good to actually see that in the wild. [...] [...] Embedding JavaScript inside a Quicktime movie is nothing new as GNUCitizen discussed back in September but it’s good to actually see that in the wild. [...]

]]> By: pdp /blog/backdooring-quicktime-movies/#comment-2796 pdp Thu, 25 Jan 2007 22:11:38 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-2796 I am not quite sure how to do that but I know that it is possible since I did it before. Try to mess with the target field <pre><code>A<javascript:alert("hello from backdoor")> T<target></code></pre> I am not quite sure how to do that but I know that it is possible since I did it before. Try to mess with the target field

A<javascript:alert("hello from backdoor")> T<target>
]]> By: Nick /blog/backdooring-quicktime-movies/#comment-2793 Nick Thu, 25 Jan 2007 20:45:58 +0000 http://www.gnucitizen.org/blog/backdooring-quicktime-movies#comment-2793 How do you pop the browser directly from quicktime standalone player? I can make it work from within the browser, but I want it to pop directly from the stand alone player. How do you pop the browser directly from quicktime standalone player? I can make it work from within the browser, but I want it to pop directly from the stand alone player.

]]>