Difference between revisions of "Exploiting the media for fun and profit. Analysis of a new type of web application attacks through media files"

From OWASP
Jump to: navigation, search
(added link header)
 
Line 5: Line 5:
 
== The presentation  ==
 
== The presentation  ==
  
[[Image:Owasp_logo_normal.jpg|right]]As the criminals adapt, they look for new ways to distribute malware.
+
[[Image:Alex_photo.jpg|right]]As the criminals adapt, they look for new ways to distribute malware.
 
This talk will examine new types of malware that spread through online videos, music files, and images.  We begin by analyzing media malware trends, and discover that many of the attacks are not targeted and that they are usually reliant on social engineering and blackhat search engine optimization. Next, we provide a taxonomy of different attack vectors. We show that music and video files are commonly infected via URLANDEXIT script injection or DRM licensing abuse, where a user is tricked into downloading a "fake codec". We analyze a growing trend of fake Youtube sites, covering the latest news events. These sites are often advertised through social networking sites, such as Facebook. We demonstrate how easy it is to set up such sites, via a YTFakeCreator toolkit. We then discuss how images of Angelina Jolie have been used to exploit JPEG GDI buffer overflow vulnerability in the past, and how it's still prevalent nowadays. Finally, we discuss some protection mechanisms, ranging from OS configuration changes to disable URLANDEXIT commands, to a custom tool (that will be open-sourced after the talk), which can help easily detect the malware before downloading the entire video. Our tool uses some innovative ideas, such as sequential downloads of the media file, and entropy analysis to detect injected script commands.
 
This talk will examine new types of malware that spread through online videos, music files, and images.  We begin by analyzing media malware trends, and discover that many of the attacks are not targeted and that they are usually reliant on social engineering and blackhat search engine optimization. Next, we provide a taxonomy of different attack vectors. We show that music and video files are commonly infected via URLANDEXIT script injection or DRM licensing abuse, where a user is tricked into downloading a "fake codec". We analyze a growing trend of fake Youtube sites, covering the latest news events. These sites are often advertised through social networking sites, such as Facebook. We demonstrate how easy it is to set up such sites, via a YTFakeCreator toolkit. We then discuss how images of Angelina Jolie have been used to exploit JPEG GDI buffer overflow vulnerability in the past, and how it's still prevalent nowadays. Finally, we discuss some protection mechanisms, ranging from OS configuration changes to disable URLANDEXIT commands, to a custom tool (that will be open-sourced after the talk), which can help easily detect the malware before downloading the entire video. Our tool uses some innovative ideas, such as sequential downloads of the media file, and entropy analysis to detect injected script commands.
  
== The speaker ==
+
== Aleksandr Yampolskiy ==
  
Speaker bio will be posted shortly.
+
"Aleksandr Yampolskiy, Director of Security and Compliance, Gilt Groupe.
 +
Aleksandr Yampolskiy is responsible for all aspects of security at the Gilt Groupe: application security, protecting the company through penetration testing and auditing of network infrastructure, establishing IT security controls, conducting security awareness training, fraud detection, and overseeing PCI compliance efforts. Prior to this position, Aleksandr Yampolskiy has worked at Goldman Sachs, Oracle, Microsoft in various capacities. He has been a lead technologist for SSO, entitlement, IDM, and identity federation solutions. Aleksandr Yampolskiy has advised various businesses on best practices for integrating security into their products, while complying with internal/external policies and regulations. Aleksandr has been cited in NY Times, Yale Scientific, and published half a dozen articles in top security conferences. In 2006, he was awarded the Best Paper Award in Public Key Cryptography conference for discovering the most efficient Verifiable Random Function to-date. He has a B.A. in Mathematics/Computer Science from New York University, and a Ph.D. in Cryptography from Yale University."
  
 
[[Category:AppSec_DC_2010_Presentations]] [[Category:OWASP_Conference_Presentations]]
 
[[Category:AppSec_DC_2010_Presentations]] [[Category:OWASP_Conference_Presentations]]

Latest revision as of 20:34, 13 October 2010

468x60-banner-2010.gif

Registration | Hotel | Walter E. Washington Convention Center

The presentation

Alex photo.jpg
As the criminals adapt, they look for new ways to distribute malware.

This talk will examine new types of malware that spread through online videos, music files, and images. We begin by analyzing media malware trends, and discover that many of the attacks are not targeted and that they are usually reliant on social engineering and blackhat search engine optimization. Next, we provide a taxonomy of different attack vectors. We show that music and video files are commonly infected via URLANDEXIT script injection or DRM licensing abuse, where a user is tricked into downloading a "fake codec". We analyze a growing trend of fake Youtube sites, covering the latest news events. These sites are often advertised through social networking sites, such as Facebook. We demonstrate how easy it is to set up such sites, via a YTFakeCreator toolkit. We then discuss how images of Angelina Jolie have been used to exploit JPEG GDI buffer overflow vulnerability in the past, and how it's still prevalent nowadays. Finally, we discuss some protection mechanisms, ranging from OS configuration changes to disable URLANDEXIT commands, to a custom tool (that will be open-sourced after the talk), which can help easily detect the malware before downloading the entire video. Our tool uses some innovative ideas, such as sequential downloads of the media file, and entropy analysis to detect injected script commands.

Aleksandr Yampolskiy

"Aleksandr Yampolskiy, Director of Security and Compliance, Gilt Groupe. Aleksandr Yampolskiy is responsible for all aspects of security at the Gilt Groupe: application security, protecting the company through penetration testing and auditing of network infrastructure, establishing IT security controls, conducting security awareness training, fraud detection, and overseeing PCI compliance efforts. Prior to this position, Aleksandr Yampolskiy has worked at Goldman Sachs, Oracle, Microsoft in various capacities. He has been a lead technologist for SSO, entitlement, IDM, and identity federation solutions. Aleksandr Yampolskiy has advised various businesses on best practices for integrating security into their products, while complying with internal/external policies and regulations. Aleksandr has been cited in NY Times, Yale Scientific, and published half a dozen articles in top security conferences. In 2006, he was awarded the Best Paper Award in Public Key Cryptography conference for discovering the most efficient Verifiable Random Function to-date. He has a B.A. in Mathematics/Computer Science from New York University, and a Ph.D. in Cryptography from Yale University."