Your media player could be a hacker's playground

Your media player could be a hacker's playground

JORDAN ROBERTSON

Associated Press

August 2, 2007 at 9:24 PM EDT

LAS VEGAS — Media players in personal computers have serious vulnerabilities that could allow online criminals to attach malicious code and infect computers without the user's knowledge, a researcher said Thursday.

As a result, audio and video downloads can be turned into digital weapons that hackers could use to hijack or corrupt computers, said David Thiel, senior security consultant with San Francisco-based researcher iSEC Partners.

Mr. Thiel, who exposed the flaws on relatively obscure open-source media players during a presentation at the Black Hat hacker conference, said he has found several flaws in popular commercial players. But he declined to provide their brand names because, he says, he is still disclosing the exploits to the companies so they can issue fixes.

He isn't aware of any current attacks using the vulnerabilities he's discovered but said they're hard to track.

“The actual potential for attack is reasonably severe because nobody cares about actually playing videos from YouTube or playing music on Web pages — you can't get music to stop playing at you,” he said. “Because this stuff is launched automatically, I think the impact could be significant.”

Paul Proctor, a research vice-president with Gartner Inc., said Mr. Thiel's findings could pressure companies to investigate flaws in their media players and patch them quickly.

Hackers have targeted media players before, Mr. Proctor said, but Mr. Thiel's attacks appear to infiltrate the machines more deeply and circumvent traditional Internet safeguards.

Mr. Thiel unveiled a new program using a technique called “fuzzing” — corrupting the files used in applications in a controlled way to find exploitable bugs — to identify weaknesses in various media players.

“This is a new frontier for hacks,” Mr. Proctor said. “The straightforward, basic truth is that companies that make media players of all types will have to become as vigilant.”