Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I'm not familiar at all with IT Security, but I'm a bit curious about something. I was watching a TV show and at one point, a virus spreads through an office. They investigate and find out that the virus was encoded in a video and it was "activated" when the video was played. So my question is, is this possible? Could that actually happen? Once again, I'm not at all familiar with either IT Security or video encoding/codecs, so forgive my ignorance.

EDIT:

Thanks for all your answers. They were very interesting and insightful. If you're interested, the show in reference was White Collar Season 3 Episode 7 "Taking Account".

share|improve this question
3  
    
@AndrewSmith Did you even read the question correctly? I highly doubt everyone in the office has a TV.. and, computers can play videos as well... right? - and gegal, good show. –  ekaj Aug 3 '12 at 23:11
add comment

6 Answers

up vote 51 down vote accepted

Yes, that's possible.

The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine.

These types of exploits have been common amongst popular document formats, e.g. PDF. Their proliferation makes them a good target for exploit writers, because people use them a lot and assume they're safe. At the end of the day, any file type could potentially contain an exploit, since an application that runs executable code is involved at some point.

Exploits like this are usually buffer overflow attacks, which alter control flow by overwriting data structures outside the normal memory range of a buffer.

More info:

share|improve this answer
    
Thanks. I just want to see if more answers trickle in before I mark you as the answer. I +1'd you in the meantime. –  qegal Aug 3 '12 at 8:22
1  
Of course, exploits like that rarely work against more than one type of reader/player software at the same time -- IE, a bug in windows media player's ogg decoder does not imply that VLC would suffer from the same glitch. So the attacker would have to know beforehand which client the target is using -- or just fire scattershot via spam and make sure the virus dials "home" once it hits. –  Shadur Aug 3 '12 at 14:04
7  
Usually this is correct, however some players use the same shared library for a given codec (usually on the same OS, but not always) so a vulnerability that is expressed in a shared library could compromise the security of multiple players (or even operating systems). In this case, the player itself is not the actual infection point, the library is. –  Chris Nava Aug 3 '12 at 14:38
    
Chris is correct here. Most players share codecs and libraries, e.g. ffmpeg, making generic exploits easier to craft. –  Polynomial Aug 3 '12 at 14:40
1  
It is entirely possible to create a video codec with no possibility of exploitation. Such a codec would have limited flexibility however. –  Joel Cornett Aug 3 '12 at 20:17
show 1 more comment

There is a pretty nice play-by-play of a real-life example of this on h-online (german it publisher). In this case it's a purposed flash video that contains several different attacks to infect the computer trying to display the video

share|improve this answer
add comment

Take a look into this window's bulletin, which describes a patch to fix the jpeg parser (infected by viewing a jpeg image, ouch).

So, it certainly is possible. It is just a matter of finding a hole to execute a custom code. This is usually done by some kind of buffer overflow (see for example here).

share|improve this answer
    
I actually found some malware exploiting that bug, many moons ago. Just browsing to a page with a crafty JPEG was enough to trigger code execution. –  QuasarDonkey Oct 12 '12 at 0:59
add comment

Besides @Polynomial's buffer overflow possibility, the "video file" could actually be a trojan executable. Here's a simple example:

  • An executable file is named such that it appears to be a video, like:
    "movie.avi                     .exe"
  • The executable extracts the video data embedded in it, starts your video player, and meanwhile deploys its malicious payload.

To the user, it appears that they've clicked a video file and it opened in their video player just like normal. Instead, they've been tricked into running the trojan.

Edit to add: This is the inverse of your question title. Instead of a virus encoded in a video, a video is encoded in a virus.

share|improve this answer
1  
Your final sentence isn't really correct. Neither are encoded in either. It's just an executable with a name designed to trick people. –  Polynomial Aug 3 '12 at 14:42
    
That's a fair point, and that's why I preferred "embedded" in my example. I kept "encoded" to mirror the question title. Of course, there's also the possibility that the video data isn't contained in the executable and is instead downloaded on the fly or is in another file on the computer already. The important part is that the trojan does play a video alongside infecting the host. –  Simon Aug 3 '12 at 14:57
    
There are also trojans of this nature that don't attempt to play a decoy video, but that wouldn't fit the scenario in the question. –  Simon Aug 3 '12 at 15:00
2  
This is precisely why in Windows I always un-check "Hide file extensions". –  7wp Aug 3 '12 at 16:34
1  
@7wp, and so I can actually rename .txt files to .py or something else :) –  Wayne Werner Aug 3 '12 at 18:54
show 2 more comments
  • Flash runtime is using Main Concept H.264/AAC as well MP4 demux container format from the same company. There is also fMP4 format with very advanced meta-data. This is pretty much secure software.
  • Flash is also using MP3 audio, VP6 video and Nelly Moser audio formats with FLV muxing, this is is somewhat secure as well however I havent tested this one.
  • There is also Windows Media ASX/WMV/VC-1/WMA formats used by all Windows Browsers and Windows Media Player OCX
  • On linux there is VC-1 player replacement with mplayer
  • VLC plugin is one of the easiest, if user has plugin it's easy to crash the browser
  • Microsoft H.264 addon is using Windows 7 H264 and MPEG-2 decoder to play DVDs, blue-rays as well HD transport streams
  • Shoutcast protocol is also widely used
  • Firefox has Theora video and OGG audio, which is open source.
  • OSX (MAC/iphone/ipad) has MPEG-2 TS decoder done by Apple and works in Safari browser
  • UK freeview Set Top Box is using libcurl / VLC to play the videos
  • Smart TVs are using various open source libraries or same as on Sony Playstation (Sony TV)
  • Android 4 is using MPEG-2 decoder via browser too
  • Silverlight runtime is using Windows Media, H.264 decoder from Microsoft on Windows and Microsoft Phone

There are many other players which can run viruses, some TV's utilize complete scripting which can be injected thru the DVB-T terrestial or DVB-S satellite signal, which is sometimes performed to take out the pirate boxes.

So you see, you can make a living just by hacking video formats. Most of them has serious holes, with the most dodgy one being VLC and the most secure Main Concept.

The show you have seen doesnt need to be true, to actually perform this on main concept itself it's not likely however some formats had bugs previously, but since the adobe player has autoupdate, the problem is much better at the moment than 5 years ago, when the show was shot

share|improve this answer
1  
Wait... am I reading "Flash" and "is secure" in the same sentence? I should go check in with my optometrist. –  Iszi Aug 31 '12 at 16:02
    
Well compared with other players in terms of video routines it's very stable, unlike Vlc –  Andrew Smith Aug 31 '12 at 18:26
    
does flash player is secure,i guess pro-grammatically encode the virus with an swf video! –  BlueBerry - vignesh4303 Oct 25 '12 at 13:10
add comment

Yes, it is possible. The video player may have a vulnerability that can be exploited via, i.e., a buffer overflow.

When the particular video file created by the hacker is played on that particular video player, the player will hang and the connection will be transferred to the host and the hacker can access your system remotely every time you are connected to the internet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.