QuickTime flaw could download spyware

A flaw in Apple's QuickTime file format could allow spyware to be downloaded to collect personal information from users.

According to Didier Stevens, who works as an independent security researcher, the flaw can allow a QuickTime movie to execute a piece of Javascript code that in turn downloads spyware onto a victim's computer.

He said that at present a French rock band is using the technique to find out information about users visiting the band's MySpace page. On the page is embedded an invisible QuickTime video which uses the software's HREF function to run the script.

"It will automatically execute JavaScript code when the movie is played - since there is no timestamp, the script executes immediately," said Stevens.

The data unearthed by the script is uploaded to a server at profileawareness.com which is a website that tracks people visiting MySpace pages.

He said the script is detected by McAfee's anti-virus product and this was the only one to do so at the time of writing his blog. Its software detects the spyware as a JS/SpaceTalk trojan.

"The QuickTime movie is what is known as a downloader, but anti-virus programs do not detect it," he said. "The downloaded script is just spyware, it will collect data about the Myspace user viewing the page and upload it to a server."

According to Apple, a patch for the flaw was released in its last security update that fixed both OS X and Windows versions of the software.

Email to a friend

Print this page