Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the case of pirating multimedia, be it video or music, which problems may be caused by the video or music file itself? Could a video or an audio file be used to spread malware?

I'm talking about the file itself, not about vulnerabilities on the software used for download nor the media player.

If the file were a picture, then steganography may be present.

share|improve this question
    
I thought it was clear with the software example. I'm asking about the first one, if is it possible to spread malware within video or music files. –  yzT May 9 '13 at 10:30
    
@Adnan's answer and your comment to it makes it clear that I wasn't the only one that thought your question is ambiguous. Thanks for clarifying, tho. –  Noordung May 9 '13 at 10:37
2  
@yzT please see the FAQ. This site is collaboratively edited, like Wikipedia. If you are not comfortable with the idea of your contributions being collaboratively edited by other trusted users, this may not be the site for you. Everyone here is just trying to improve the content. –  AviD May 9 '13 at 11:11
    
Dear yzT, a non-executable file cannot magically infect your machine unless it triggers a vulnerability in the software that supposed to run it or your operating system. –  Adnan May 9 '13 at 11:12
1  
@yzT Your question was not a good question, in fact (IMO) I think it was a bad question. You're forcing your own misconceptions and refusing to understand what is correct. I tried to make it suit our Q&A format in a better fashion. If you have a follow up question, please state it and we'd all be more than happy to help you. –  Adnan May 9 '13 at 13:46

2 Answers 2

There are several risks when it comes to piracy, both legally and from a security point of view. I'll try to approach them as well as possible.

The downloaded files themselves:

  • Downloaded with the .avi, .mp4, .mkv, etc. there might be some executable files, with some special icons that can trick the user into clicking them, thus executing malicious code.

  • The media file itself (the movie or the song) could be specially crafted in a way to exploit a vulnerability in the user's media player, thus executing malicious code. (For both this point and the one before, please take a look at this answer for more information)

The software used to download the material

  • It could have a vulnerability in handling certain requests, giving the chance to an attacker to exploit it and execute malicious code. Remember that in P2P filesharing (BitTorrent, for example) you're revealing your IP address and disclosing the the torrent application's name, version, and the listening port.

  • It could have a vulnerability in handling certain files, allowing a specially crafted executable or non-executable file to execute malicious code.

The website from which you're download the material

  • Many fake warez websites trick visitors into download "plugins" or "accelerators" to help them download the materials. Those files are most likely malware.

  • This kind of websites can be a good target for watering hole attacks especially after the release of a big blockbuster.

Legal implications

  • Because you're revealing your IP address to the swarm, anybody downloading the same file with you can have your IP and thus possibly your identity, which leaves you vulnerable to legal prosecution by copyright holders.

  • Your ISP might (sometimes without a warning) report to copyright prosecution firms.

Solutions?

Well, talking about this is somewhat controversial, so I'll do my best here.

The Scene has a strict vetting policies that makes it difficult to upload malware in their releases, a large network of people whose sole purpose to produce better quality releases. The risk is minimized by using invite-only private trackers, where users are kicked with no possibility to come back if they attempt to spread malware.

All in all, there will always be a risk, but like anything with security, you can take some steps to minimize it.

share|improve this answer
    
Thanks for your answer but the only part related to my question in whole your answer was the point 2, and the example you gave is related to picture stenography (as I said). I'm interested in video or music, do you have an example about specially crafted video or music? –  yzT May 9 '13 at 10:34
    
@yzT There are literally thousands of examples of vulnerabilities in software that could allow video and music files to execute malicious code. Here are some examples: emagined.com/securityfocus-advisory/48130/… , checkpoint.com/defense/advisories/public/2013/… , vuxml.freebsd.org/freebsd/… , support.microsoft.com/kb/936782 , support.microsoft.com/kb/2378111 –  Adnan May 9 '13 at 10:43
1  
It's too short for me to make an edit out of it, but I presume you mean "executable" instead of "excitable" in the first bullet point? –  John Bensin May 9 '13 at 13:33
    
@JohnBensin Oh god! Thank you, I've corrected it. I don't know why I wrote that. –  Adnan May 9 '13 at 13:35

Could a video or an audio file be used to spread malware?

Yes, for certain kinds of media file.

In addition to everything Adnan wrote, it is possible for Windows Media (ASF/WMV/WMA) files to launch web pages. The idea is that for DRM-impaired files it can send you to a site to buy a licence to view it. Of course it can also send you the usual web threats of browser/plugin exploits, fake codecs and other scams.

Abuse of this misfeature was common in the mid-00s though seemingly not so much now. You also get the opportunity to turn the feature off now at WMP first run, though it is on by default.

This threat doesn't apply to the common open file formats like the MPEG family, but unfortunately WMP will happily open a WMV file that has been mislabelled as .mp4, so you can't rely on the apparent-filetype.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.