Worm targets Real Media files
McAfee warns of dangerous movies and music.
Researchers at McAfee's Avert Labs have warned of a new worm, dubbed 'W32/Realor', which doctors the
contents of Real Media files (.rmvb) to redirect users to potentially dangerous URLs.
The worm does not 'infect' the media files in the standard sense, but instead manipulates the functionality of
Real players to redirect anyone trying to view the files to a website, generally one containing an exploit
enabling drive-by downloads. From there further copies of the worm or other malware can be installed to vulnerable
systems.
'As Avert researchers point out, the main danger of this worm lies in the public's general assumption of safety
when handling media files,' said John Hawes, Technical Consultant at Virus
Bulletin. 'With the popularity of public-access media sites like YouTube, all media formats are becoming popular
targets for malware exploitation, from both technical and social-engineering angles. Hopefully people's trust in these
formats is being eroded, and they'll soon be treated like anything we get from the web should be - a potential danger
until proven otherwise.'
A McAfee blog entry on the discoveries is here, with
more in-depth analysis of the worm here.
17 November 2006
Tags:
del.icio.us 
digg this
This month's VB100 test saw some major changes and a radical overhaul of the VB100 test methodology - for the first time allowing products to use their 'cloud' look-up systems. John Hawes has all the details.