Beware that WinAmp skin

Internetnews.com ^ | August 26, 2004 | Ryan Naraine

[JoJo Gunn]

Beware That WinAmp Skin
By Ryan Naraine
August 26, 2004

The popular skinning feature in Nullsoft's WinAmp media player has left the door wide open for malicious attackers to hijack PCs.

Security researchers at K-Otik discovered the vulnerability and released details of a "Skinhead" zero-day exploit that is already spreading in the wild. The exploit, which targets WinAmp versions 3.x and 5.x, is being used to forcefully install spyware and Trojans on infected systems.

Secunia has tagged the flaw as "extremely critical," its highest rating.

WinAmp skins have a huge following because they allow users to adopt colorful, customizable and interchangeable sets of graphics that change the look and feel of the software.

According to an advisory from Secunia, the problem is caused due to insufficient restrictions on WinAmp skin zip files (.wsz). It means a malicious Web site could use a specially crafted WinAmp skin to place and execute arbitrary programs.

With Microsoft's (Quote, Chart) Internet Explorer browser, this can be done without user interaction.

Analysis of the zero-day exploit shows that attackers are using an XML document in the WinAmp skin zip file to reference a HTML document using the "browser" tag and get it to run in the "Local computer zone". "This can be exploited to run an executable program embedded in the WinAmp skin file using the "object" tag and the "codebase" attribute," Secunia explained.

The vulnerability has been confirmed on a fully patched system with WinAmp 5.04 using Internet Explorer 6.0 on Microsoft Windows XP SP1.

PivX Labs, which has also analyzed the attack vector, said that a user visiting a Web site that hosts the Skinhead exploit will have their browser redirected to a compressed WinAmp Skin file which has a WSZ file extension, but which in reality is a ZIP file.

The company said the default installation of WinAmp registers the WSZ file extension and includes an instruction to Windows and Internet Explorer to automatically open the files. It leads to the fake WinAmp skin being automatically loaded into the media player.

America Online (Quote, Chart) owns Nullsoft.

[Darksheare]

LOL!

Wild Tangent made a few plugin games for WinAmp.. one of them being a driving game that was pretty cool.
Problem was, they stuffed it so full of spyware that it bloated it's coding way out there.
Dunno why they even bothered.

[Darksheare]

Thanks!
Tried Winrip, it goofed things up, slowed the machine down, and left all kinds of registry gunk behind when it was uninstalled.
It handled decoding mp3's in a craptacular fashion.
(Made them sound tinny, even the 320 bitrate ones.)

[Not A Snowbird]

Great, worldwide tech support! I love it!

(I was afraid to ask what this was... knowing this group, it could have been something... well... you know.)

[JoJo Gunn]

Winamp 2.8 ain't bad, if you tell it up front you don't have an internet connection. (I'm not one to use media players on the web anyway).

Real Player is something else again. I learned the first time I tried it how devious those *******'s were, when during an install dialog box there were plenty of unchecked items, but only if you scrolled down did you see 3 or 4 boxes pre-checked giving authorization to phone home. Why wasn't that up front?

What also ticks me off is that over here PBS, (the "educational" organization that gets too much of our tax dollars), forces people to use that garbageware if they want to access anything.

[JoJo Gunn]

Wild Tangent comes bundled with this little HP of mine. Whenever I do a reinstall it's one of the first things to be removed. (I can't remember what the name of it is, but a driving game is one of the things in the bundle. Maybe it's the same one? It looked pretty good, but I didn't like the idea of going on-line every time I wanted to play it. And anyway, not long afterwards I discovered Mame32 and other emulators).

[JoJo Gunn]

I just looked up Winrip, and to me it doesn't look like much to spring 20 bucks for.

CDex doesn't record, neither is it the prettiest, but for ripping and converting it does very well.

A man who messes with audio more than casually should have Goldwave in his toolbox as well, by the way. It's a sound editor, trialware with the typical nag screens, but fully functional. My experience is with version 4.26, which is still available on the site.

Goldwave

[JoJo Gunn]

"knowing this group, it could have been something... well... you know...."

And I was being so sincere.

[Conspiracy Guy]

I use Mule Skinner 1.0. It is slow but reliable.

[Darksheare]

You can tell it to "GOMF" (get outta my face) in it's settings, but you have to hunt the specific preference settings down.
Like it's internet DBBA database setting..
I gutted that thing when I found it.
Also told it not to report usage stats.

[Darksheare]

Isn't that a huge knife?

[Conspiracy Guy]

Sharp is more important.

[Darksheare]

True, true.
Sharp is important, I prefer razor edged but that's difficult to maintain under real-world situations.

[Conspiracy Guy]

Use a flint knife. Flint doesn't dull like steel.

[Darksheare]

Drat, was using obsidian.

[Conspiracy Guy]

Flint, flint, flint.