Priyanka Joshi/Rediff
New Delhi, Oct 16: The next time you download a video clip from YouTube or any other video-hosting website, you could possibly be downloading a malicious code along with the clip that could infect your computer, take unauthorised control, and steal financial or other information from it.
''Users have got accustomed to not clicking on messages from banks and erstwhile e-card companies, but everybody wants to see videos from YouTube and similar sites,'' explains Kartik Shahani,sales director, McAfee India. As the popularity of flash media file formats continues to increase, hackers can now corrupt computers once the user has downloaded a media file onto the machine, or through video files when played on a media player.
A recent Georgia Tech Information Security Centre report reasons that as the Web 2.0 phenomenon makes Web applications more interactive and improves user experience, "it also pushes more code execution onto the client browser. ''Attackers will continue to post malicious links as part of the user's everyday online activity - at the end of an instant messaging (IM) string, hidden in a YouTube video or embedded in an Excel spreadsheet,'' noted Paul Judge, Senior Vice President and Chief Technology Officer, Secure Computing, in the report.
When browsing a Web 2.0 site, "the user's browser silently makes requests and communicates with the Web application in the background. This scenario gives hackers the opportunity to embed malicious code on an otherwise legitimate website, which the user's browser will automatically execute", explains the report.
Over the past few years, hackers have moved from sending their spam in text-based messages to more devious means, embedding them in images or disguised as Portable Document Format (PDF) files. ''The next logical direction was videos and user generated multimedia content that is quite popular,'' says Lumension Security's regional director (India and SAARC), Shamshad Ahmed.
''In some cases, the web-enabled phones are used to view videos and that could either damage the mobile data or allow the hacker to access the handset data,'' notes Ahmed.
Lumension is quick to point out, that IT administrators must add video data to corporate security policies. ''Businesses can no longer assume the position that video data is benign.''
Blocking the virus programmes to download themselves automatically, the corrupted video files can be prevented from doing any harm to the user machine. McAfee prescribes that all media players should be included in security patching policy and execution.