That's the lesson for Winamp users, after a group of security researchers discovered that spyware makers are using a flaw in the way the multimedia software loads graphical themes, or skins, to infect PCs with their wares. The digital music player--made by America Online subsidiary Nullsoft, whose informal mascot is the llama--improperly allows the skin files to run programs.
The flaw is being used by some spyware makers to infect people's computers with their illicit programs, according to another group of researchers, at French company K-Otik Security. The attack had been used to spread spyware among Internet relay chat users, infecting a computer after the victim clicked on a Web address that appeared in the chat window.
"We received several reports from users who were hacked after clicking on a link distributed on several IRC (Internet relay chat) channels," said Chaouki Bekrar, a consultant and co-founder of K-Otik. Clicking on the link infected the users' computers and sent out additional instant messages, Bekrar said.
The vulnerability is the latest flaw to arrive without warning. Knowledge of such flaws--known in technical circles as zero-day, or 0-day, vulnerabilities--can spread widely before the software developer can even fix the problem. A similar issue in Microsoft's Internet Explorer browser enabled spyware intruders to load software onto the PCs of visitors to an intruder's Web site. The seriousness of the flaw convinced Microsoft to release an early fix for the problem.
A representative of America Online said the company had been made aware of the problem but that a fix had not yet been created. "We're looking into the reports and will provide more information, as necessary, at the appropriate time," the representative said.
Security information provider Secunia rated the vulnerability "extremely critical," its highest rating for software threats, and said the threat extends beyond instant messaging to any skin downloaded through a browser link or e-mail link.
"A malicious Web site using a specially crafted Winamp skin to place and execute arbitrary programs" could take control of a victim's computer, the company said in a Wednesday advisory. "With Internet Explorer, this can be done without user interaction."
But the security site suggests a simple solution to the problem in its advisory: "Use another product."
America Online could be forgiven for not appreciating the advice.
There's no need to "use another product" - but rather then realize that if you click on a link to a .wal file, but the link "points" to a .jpg file... then something's probably wrong.
Is support for running as a limited user, not a Power Luser or Admin. There are workarounds, but the product needs full support because it is generally used by kids who are really adept at stumbling into computer hostile environments.
Prominent corporate governance organization says Facebook's dual-class stock structure gives CEO Mark Zuckerberg too much control over the company's future.
While some are blaming technology for an increase in one night stands, perhaps it's simply the brevity with which people communicate by phone that suggests swift progress to sexual congress.
When the sun goes down, that's when the iPad gets busy for folks with news readers. The iPhone? It's more of a daytime habit. If you're building an app for both devices, heed the lesson.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
<a class="jive-link-external" href="http://forums.winamp.com/showthread.php?s=&threadid=190902" target="_newWindow">http://forums.winamp.com/showthread.php?s=&threadid=190902</a>
There's no need to "use another product" - but rather then realize that if you click on a link to a .wal file, but the link "points" to a .jpg file... then something's probably wrong.
<a class="jive-link-external" href="http://www.winamp.com/player" target="_newWindow">http://www.winamp.com/player</a>
Further info:
<a class="jive-link-external" href="http://www.winamp.com/about/article.php?aid=10605" target="_newWindow">http://www.winamp.com/about/article.php?aid=10605</a>
<a class="jive-link-external" href="http://forums.winamp.com/showthread.php?threadid=191604" target="_newWindow">http://forums.winamp.com/showthread.php?threadid=191604</a>
<a class="jive-link-external" href="http://forums.winamp.com/showthread.php?threadid=190902" target="_newWindow">http://forums.winamp.com/showthread.php?threadid=190902</a>