1

For sake of example, let's say you were given an MP3 file, and you downloaded and played it? Could you get a virus from this?

I'm also interested in other types of files such as .iso, etc. (.exe files excluded)

5
  • I'm just interested on how malicious actors can backdoor iso and mp4 files etc and what the process consists of. – user24113 Nov 14 '16 at 17:13
  • I don't understand how it isn't specific? I'm wondering about the methods that attackers use in order to hide malicious code inside of casual looking iso and mp4 files in order to gain access to your machine. – user24113 Nov 14 '16 at 17:20
  • 1
    Let's say the mp3 file was given to you and then played. – user24113 Nov 14 '16 at 17:36
  • Thanks, I edited your question. This is a pretty aggressive edit so I encourage you to edit further if you don't like what I did. – 700 Software Nov 14 '16 at 17:39
  • 1
    It's fine, thank you. I'm still getting used to using SE. – user24113 Nov 14 '16 at 17:40
4

It's possible to get infected with malware that sits in mp3s, jpgs, avis etc, but unlikely.

In order to get infected, the malicious code must be executed. So the audio, image or video player (specifically, the decompressor function which decompresses the data or the code which takes the decompressed data and plays/displays it) must be tricked into executing the data instead. This can happen, for example if the code reserves a fixed amount of space for the data which, if well-formed, will never take up more space. But if it does, maybe because a bad person made sure it would, it can overwrite part of the memory that follows the memory reserved for the data, and sometimes that memory contains an instruction on where to find the next instructions to run after the ones currently being carried out. If the attacker can adjust this "return address" to point into his own malicious code, he wins.

If you're interested in the technical details, google "buffer overflows" and "stack smashing".

So... it's not the audio/video file itself that's dangerous. It's the combination of the file and a specific audio/video player.If you don't watch the infected file with the target player, nothing will happen.

2
  • What about a file that is downloaded and played locally? – user24113 Nov 15 '16 at 7:39
  • As I said, if the file is infected with malware targeted to the player you're using, you've lost. This is why it's important to keep your system updated - older software tends to be more vulnerable, since there was more time to discover flaws that can be exploited. – Out of Band Nov 15 '16 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.