How a rogue .wmv file abuse DRM to "hijack" Windows Media Player and download malware
Posted by RonDunE@reddit | programming | View on Reddit | 2 comments
EduardoBPrado@reddit
The problem is that Microsoft allowed DRM protected media to open up a dialog that would host the MS IE core / engine and direct to a pre-defined URL to purchase, download and apply a license to play the media file. This happens without user consent, which is a security issue for much more than 10 years (as the post is 10 y.o). Those running obsolete OSes that have the component should change their WMP privacy settings NOT to allow this dialog to open up automatically: Open WMP, then hit 'F10' button to display the Menu Bar, then click 'Tools' menu. The menu options will display. Click 'Option...' menu, then click the 'Privacy' tab, then uncheck the option 'Download usage rights automatically when I open or sync a file'. Click the 'Apply' button, then 'OK' button. That´s it, every time a DRM protected file is played, a security warning will show informing that a license mut be acquired to play the file and the following URL will be opened:
- http://URLHERE -
So the user has the option to allow or deny. (Do not donwload usage rights automatically should have been default option for MANY years). With the release of PlayReady back in 2007, Microsoft dropped support for this older DRM system (WMDRM) so for many years this license acquisition thing has only been actually used by malicious people to trick users into downloading malware to their devices. Microsoft knew it but left Windows 10 (v.1507 / 1511 only) users prone to attacks until yesterday!
RonDunE@reddit (OP)
I suspect it was kept alive for this long due to some sort of backward compatibility workaround. It seems such an obvious fix otherwise.