Question about keyloggers / Viruses

On August 02 2008 09:09 IntoTheWow wrote:
Who do you want to infect lol

On August 02 2008 11:23 HeadBangaa wrote:
If you want to be evil, compile your trojan and bind it with an executable that simply displays an error message "Wrong Windows version. Windows 95 required", name the extension of the resulting executable to ".scr" and tell people it's a screen saver.
The funnest part about microhacking is the social engineering~

On August 02 2008 11:12 0xDEADBEEF wrote:
Roughly speaking, there are two types of files: executables and everything else. The most common executables are .exe, .scr, .com, .lnk (shortcut), and several scripts like .bat, .vbs, .wsh and so on. There are more.

Other files are usually just for storing data in a certain format. MP3 is a simple audio format, there's nothing in there that your computer will execute by default.
However, there might be a tiny chance that the music player you use won't handle a malformed/manipulated MP3 file correctly, and if that's the case, there MIGHT be a way to smuggle executable code into it. In the past there was one version of Winamp which allowed for "virus MP3s": play a MP3 and code gets executed, just like with a .exe. This requires the player to have a bug which allows that, though... and that's really almost never the case, I think it happened only that one time, and that's years back.

On August 02 2008 15:17 kdog3683 wrote:
Anyway to distinguish between these fakes and legit mp3's before you run it?

These “MP3″ files are in fact ASF files that instruct media players such as Windows Media Player to navigate to a specified URL (via the default HTTP protocol handler - ie. default browser). Not all media players support this functionality.

On August 02 2008 22:18 0xDEADBEEF wrote:
So basically it's just a deception thing... a bit like renaming .mp3 to .mp3.exe and hoping the user has hidden file extensions.
The thing is, MP3 files have no such functionality by default, so if you try to play a MP3 and your media player directs you to a URL you know that there's something wrong about this file (i.e. it's NOT actually a .mp3) and that they want you to download malware. Opening the file, though, does not by itself harm you unless you use this trick and direct the browser to a webpage which tries to exploit a security hole in the browser. If that's not the case (and it's hard to do so), then just playing the file and seeing this page pop up isn't doing anything yet; this trick mostly relies on user stupidity ("you need a codec please download this .exe").
And if you just use a music player which doesn't support playing .asf named as .mp3 and doesn't support such redirection URLs then nothing happens at all.

The MP3 format is inherently safe, like I wrote. This is really more of a deception/social engineering trick because it's a file format disguised as another one. A good player should have no problem detecting this. What I wrote about was about REAL MP3s, and in that case it's practically impossible to sneak malware into them unless a certain player has a certain weakness in reading MP3s in general which allows code to be executed.

On August 02 2008 22:18 0xDEADBEEF wrote:
So basically it's just a deception thing... a bit like renaming .mp3 to .mp3.exe and hoping the user has hidden file extensions.
The thing is, MP3 files have no such functionality by default, so if you try to play a MP3 and your media player directs you to a URL you know that there's something wrong about this file (i.e. it's NOT actually a .mp3) and that they want you to download malware. Opening the file, though, does not by itself harm you unless you use this trick and direct the browser to a webpage which tries to exploit a security hole in the browser. If that's not the case (and it's hard to do so), then just playing the file and seeing this page pop up isn't doing anything yet; this trick mostly relies on user stupidity ("you need a codec please download this .exe").
And if you just use a music player which doesn't support playing .asf named as .mp3 and doesn't support such redirection URLs then nothing happens at all.

The MP3 format is inherently safe, like I wrote. This is really more of a deception/social engineering trick because it's a file format disguised as another one. A good player should have no problem detecting this. What I wrote about was about REAL MP3s, and in that case it's practically impossible to sneak malware into them unless a certain player has a certain weakness in reading MP3s in general which allows code to be executed.