Gaming Can a program infect you BEFORE you open it?

[Originality]

To use an example, pictures passed over IM applications were enough to spread worms. The stories I could tell dealing with teenagers and their IM worms...

 

[twiztidsinz]

To use an example, pictures passed over IM applications were enough to spread worms. The stories I could tell dealing with teenagers and their IM worms...

And that involved the Direct Connect feature which automatically displayed the picture (WHICH IS EXECUTION OF CODE!)
Torrents do not work that way. The code you download does not get executed until you run the file yourself.

 

[Wizerzak]

I only have Avira free. I seriously can't afford to buy a good one.

Lol, I could torrent it, but nah... Not safe.

https://www.microsoft.com/security_essentials/

i love how that site shows up as https in chrome

.

 

[twiztidsinz]

I only have Avira free. I seriously can't afford to buy a good one.

Lol, I could torrent it, but nah... Not safe.

https://www.microsoft.com/security_essentials/

i love how that site shows up as https in chrome

.

Screenshot? lol

 

[Originality]

There are a few more examples of pictures infected with viruses that I came across in school. Some were just adaptations from IM worms (you open the picture file, and you get infected), but I have come across a couple that were imbedded in websites. Looking at the website that contained the infected picture would cause browsers to become infected (there were no hidden scripts or files in the sites, just the infected picture/s) and, in those cases, it would start a series of hijacking and downloading attempts to take over the browser.

I've also come across one case of MP3s that contained viruses. I heard they were very popular for a while, towards the early growth of the MP3 player trend (before the iPod made them a must-have accessory), but after people caught on the only stories I heard were from infected files spread through torrent sites trying to dislodge music piracy.

There are many ways to get a virus onto a computer - the coders have the luxury to be much more creative than the AV companies. The lazy ones would just try and find ways to trick people/programs into executing the files, whilst the more adventurous ones would find ways to get it done automatically, or even directly. That's one of the reasons why good active guards/scanning/firewalls have become an important feature in AV suites.

 

[Wizerzak]

I only have Avira free. I seriously can't afford to buy a good one.

Lol, I could torrent it, but nah... Not safe.

https://www.microsoft.com/security_essentials/

i love how that site shows up as https in chrome

.

Screenshot? lol

soz about red line, i'm tired and lazy, used snipping tool instead of PDN.

 

[whoomph]

Also, Eugene Kaspersky is a prick (I wish I still had the article).

http://blogs.computerworld.com/14940/eugen...o_net_anonymity This article?
KGB - Still watching you

 

[twiztidsinz]

Also, Eugene Kaspersky is a prick (I wish I still had the article).

http://blogs.computerworld.com/14940/eugen...o_net_anonymity This article?
KGB - Still watching you

In Soviet Russia, Web browse You!


@Wizzerzak: Awesome.


@Originality: And those images embedded in the webpage were 1). executed, 2). injected through a compromised site (or on a site intentionally spreading the virus), 3). based on browser vulnerabilities -- Exactly as I said before.
NEVER heard of a virus in an MP3 and I've been using MP3s and other digital audio formats since Winamp was still on v0.92 (early '97). I've heard of 'virus' that find MP3s and corrupt them, overwrite them or otherwise make them unusable and I've heard of virus' that are named .MP3 but aren't actually MP3s and don't play/work in MP3 players.

 

[Deleted_171835]

I only have Avira free. I seriously can't afford to buy a good one.

Lol, I could torrent it, but nah... Not safe.

https://www.microsoft.com/security_essentials/

i love how that site shows up as https in chrome

.

All that means is you're browsing with an invalid SSL certificate.

It's not like Google's hating on Microsoft's site though that would be amusing if true.

 

[Rafinesque]

Microsoft Security Essentials has gotten good reviews from some places, but PC Magazine says it's not nearly as good as some others right now :

http://www.pcmag.com/category2/0,2806,4796,00.asp

 

[Sephi]

I only have Avira free. I seriously can't afford to buy a good one.

Lol, I could torrent it, but nah... Not safe.

https://www.microsoft.com/security_essentials/

i love how that site shows up as https in chrome

.

All that means is you're browsing with an invalid SSL certificate.

It's not like Google's hating on Microsoft's site though that would be amusing if true.

 

[Urza]

@Originality: And those images embedded in the webpage were 1). executed, 2). injected through a compromised site (or on a site intentionally spreading the virus), 3). based on browser vulnerabilities -- Exactly as I said before.
NEVER heard of a virus in an MP3 and I've been using MP3s and other digital audio formats since Winamp was still on v0.92 (early '97). I've heard of 'virus' that find MP3s and corrupt them, overwrite them or otherwise make them unusable and I've heard of virus' that are named .MP3 but aren't actually MP3s and don't play/work in MP3 players.

Your ignorance and lack of reading comprehension is astounding.

 

[Rydian]

If the exploit is contained in/near the beginning of the file and is done while that's being read, then the entire file does not have to be downloaded for an infection to happen.

 

[Strider]

@OP No, it can only execute code upon being run (which might happen automatically through security issues and such, as others pointed out).

You should use software like these when executing code you're not really trusting:

Returnil System Safe
Wondershare Time Freeze

 

[Rydian]

Get the payload delivered via buffer-overflow near the beginning of a file and you could have it running before the file is downloaded.

This is partially why AV programs "lock" incoming files until they're done scanning them, and partially why ASLR is becoming a "hot" security feature.

 

[FAST6191]

Some further reading
http://www.youtube.com/watch?v=54XYqsf4JEY (it covers a lot of the concepts behind embedding things within other formats)
http://www.theregister.co.uk/2010/07/30/em...icrosoft_patch/
http://www.ustream.tv/recorded/5167328 (not strictly related again but worth seeing as it forms the basis for a fair bit)
http://www.youtube.com/watch?v=aAr03FSyod4&NR=1 (again not strictly related but covers a lot of good stuff)
I have not seen any in a while but I have seen some hacks against AV scanners (overflowing them) which is always amusing.

As mentioned though the hit rate from people actually saying yes to things running is usually a better bet than an exploit that can be patched for more long term goals.

@twiztidsinz decoding/reading is anything but executing. See various file system permissions on various systems (read, write, execute). Certainly if I load my picture of choice in a DSi or something that has picture abilities I can not be said to have ran homebrew. Certainly attacks on image libraries have been the basis for several attacks over the years but simply loading an image is not considered as such.

 

[Originality]

I have not seen any in a while but I have seen some hacks against AV scanners (overflowing them) which is always amusing.

A long time ago I came across a rather fun virus classed as "anti scanware". As soon as it detected a scanning algorithm running, it would release a series of countermeasures to preserve its "core". The interesting thing was how it pretty much mimmicked several of the "ninja" moves shown in japanese anime/games, including the famous 3 (replication, substitution and transformation/camoflage). An adapted version would do the same if you even tried to look directly at the folder in which it was located, making it harder to track down.

It's not as effective as "counter scanware", which actively attacks AV suites. If they can't hijack the AV software, it'll at least try and negate the effectiveness of scans or even block them loading in the first place.

 

[FAST6191]

Unless I am mistaken in reading your post I see that to this day (some of the latest variants of the scam AV (this thing was nasty and ten steps beyond the earlier scam AV programs but that is for a different thread) programs are great fans of this- indeed even managing to dodge rkill by "crashing" before it had time to initialise*).

I was thinking more that as the AV program scanned through the file the .text section or something would be oddly sized and this caused an overflow in the AV program which in turn provided the execution method as per more conventional overflows.

*to the one that would ask did you rename it- most of my anti nastyware programs are named for common windows components.