CSI:Internet Episode 4: Attack of the killer videos

[Peaches]

CSI:Internet

by Sergei Shevchenko

The "CSI:Internet" series was originally published in c't magazine starting with issue 13/2010. The first episode was "Alarm at the pizza service" followed by "The image of death" and "PDF timebomb". The code fragments in this article may cause your anti-virus scanner to issue an alert – this is a false alarm.

Episode 4: Attack of the killer videos

"Have you broken the computer again? It won't play this video of the new iPhone!" It's been a long day and I don't really feel like troubleshooting, but when she gets into this sort of mood, the administrator had better jump to it. And at home, the administrator is me.

Somehow I have my doubts that the origin of this problem is to be found on our PC. Maybe it's the video that's broken. In the source code of the still open web site, there's a <Object> tag containing a link to an SWF file – a video in the Shockwave Flash format which has come to dominate the internet. The URL looks more than a little strange – smelling a rat I download it onto my computer for a closer look.

At 846 bytes, it's pretty small for an SWF file – you certainly can't fit anything meaningful into that. Although it's a multimedia file, as ever I start by taking a quick look with a hex editor. Any strings, especially where you'd expect to see just incomprehensible raw data, can provide useful clue

Details & screenshot here: http://www.h-online....os-1049197.html