3

Is it possible for incoming video/audio streams to contain malware through exploits in the transfer of the video/audio?

3

It could be possible in some cases. For example, imagine that the videoconferencing software has a vulnerability into the file format parser (E.g. buffer overflow)... then it could be exploited by a remote attacker.

Look at VLC for example http://www.cvedetails.com/vulnerability-list/vendor_id-5842/opec-1/Videolan.html

  • 2
    Awesome, would it be possible for specifically Omegle to do this? – ElectricStarfish Nov 8 '14 at 9:26
  • It's potentially possible for any software. From a security perspective it's mainly concerning for remote user input whether that would be direct or indirect to cause a remote buffer overflow this happens when the programmer doesn't valid the user input very well. So, to answer your question yes it's possible. If you watch the following videos it will explain what buffer overflows are and how they are performed and so on in much more detail which will give you a better understanding: securitytube.net/video/231 – Paul Nov 8 '14 at 13:13
  • As for Omegle I believe it uses flash to display its video stream so, if an attacker finds a vulnerability in the version of flash that your machine is running he/she can easily send over something to trigger and/or exploit that vulnerability. This sort of attack is known to happen from time to time just look here... Also note that this can happen with pretty much any site that plays audio/video streams. (That's why one shouldn't browse sketchy Chinese sites looking for "entertainment"... ;) – Wolfer Nov 8 '14 at 16:56
1

Yes, it is very possible to gain remote code execution (RCE) via programs such as Skype. For example, there was a notorious exploit in the FreePBX client provided with the Elastix 2.2 platform which triggered by merely accepting a call, as can be seen here on youtube, which gives full code exeuction.

Also looking through www.exploit-db.com shows you that technologies like Skype have used or still make use of HTTP based protocols for some of their features, which have also previously been exploited succesfully.

As for Omegle: @Wolfer already correctly identified that it uses flash which has been known to have more than its fair share of bugs that have been succesfully used to create exploits, and any future ones will no doubt also have an effect on Omegle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.