QuickTime flaw could download spyware

A flaw in Apple's QuickTime file format could allow spyware to be downloaded to collect personal information from users.

According to Didier Stevens, who works as an independent security researcher, the flaw can allow a QuickTime movie to execute a piece of Javascript code that in turn downloads spyware onto a victim's computer.

He said that at present a French rock band is using the technique to find out information about users visiting the band's MySpace page. On the page is embedded an invisible QuickTime video which uses the software's HREF function to run the script.

"It will automatically execute JavaScript code when the movie is played - since there is no timestamp, the script executes immediately," said Stevens.

The data unearthed by the script is uploaded to a server at profileawareness.com which is a website that tracks people visiting MySpace pages.

He said the script is detected by McAfee's anti-virus product and this was the only one to do so at the time of writing his blog. Its software detects the spyware as a JS/SpaceTalk trojan.

"The QuickTime movie is what is known as a downloader, but anti-virus programs do not detect it," he said. "The downloaded script is just spyware, it will collect data about the Myspace user viewing the page and upload it to a server."

According to Apple, a patch for the flaw was released in its last security update that fixed both OS X and Windows versions of the software.

Rene Millman

Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.