Trojans exploit Windows DRM loophole

Dirty tricks

By John Leyden, 13th January 2005

Virus writers have subverted digital rights management features in Windows Media Player to spread Trojans and other malware. License-protected movie (.wmv) files infected with the WmvDownloader-A or WmvDownloader-B Trojans have entered circulation on P2P networks, reports Madrid-based antivirus firm Panda Software.

Normally when a user tries to play a protected Windows media file, and a valid license is not stored on a computer, the application will look for it on the internet, so that the user buy access to copyright-protected content. This new technology is incorporated in the latest Windows Media Player 10 update as well as XP SP2.

If the user runs a video file that is infected by one of the "DRM Trojans", they pretend to download the corresponding license from the net. In reality users are redirected to sites that take advantage of Windows vulnerabilities to download spyware, adware, premium-rate diallers and other viruses onto victim's machines.

The Trojans have been detected in video files with extremely variable names circulating across P2P networks such as KaZaA or eMule. File traders beware.

The video files infected by these Trojans have a .wmv extension and are protected by licenses, supposedly issued by the companies overpeer (in the case of WmvDownloader-A) or protected media (for WmvDownloader-B), Panda reports. Overpeer was previously hired by the recording industry to dump fake versions of songs on file sharing networks. Later it lobed pop-ups and adware at users. Loudeye - overpeer's parent company - told PC World last December that P2P users are getting what they deserve.

Whether overpeer has begun using more aggressive tactics is unclear, the evidence against it is circumstantial and it could be other parties have used its name as a convenient smokescreen. ®