Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Full-disclosure] Social Eng. with Windows Media Player and Codec Downlo

from [Elia Florio] Network Security [Permanent Link]
Subject: [Full-disclosure] Social Eng. with Windows Media Player and Codec Download
Date: Wed, 28 Dec 2005 20:00:39 +0100 
Here:
hXXp://www.goodmovielaugh.com/video5.html
hXXp://www.good-movie-jokes.com/video5.html

there's some malware/adware that try to use .ASX files as vector
to infect windows machines by forcing users to download and install executables.
The trick (not an exploit!!!!) is to convince people that Windows Media Player
needs an additional codec....so that users confirm the download of an EXE file.

In the page there's a reference for an .ASX file:

<ASX version="3.0">
<ENTRY>
<TITLE>Impossibile Trovare il Codec</TITLE>
<REF HREF="video.avi"/>
<DURATION VALUE="60:00"/>
<BANNER HREF="codec-alert.gif">
<ABSTRACT>Clicca qui per scaricare i codec aggiornati</ABSTRACT>
<MOREINFO HREF="http://www.vcodecreceive.com/download/VideoCodec3_05b_5.exe"; />
</BANNER>
</ENTRY>
</ASX>

The EXE file downloaded is probably some Download.Trojan or Trojan.Clicker packed with Nullsoft NSIS.

EF 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Full-disclosure] Social Eng. with Windows Media Player and Codec Download, Elia Florio <=
Previous by Date:  Re: [Full-disclosure] complaints about the governemnt spying!, GroundZero Security
Next by Date:  Re: [Full-disclosure] test this, Valdis Shkesters
Previous by Thread:  [Full-disclosure] Obsidis #1 released, Angelo Rosiello
Next by Thread:  [Full-disclosure] Re: [MailServer Notification]To recipient: Message matched eManager setting and action was taken., Leif Ericksen
Indexes:  [Date] [Thread] [Top] [All Lists]