The Anti-virus Times

Monday, December 11, 2017

Getting a system infected is easy: just be careless enough to download a malicious executable file and launch it. But what about YouTube videos? What harm can they do? You think they’re harmless? Think again!

Well, there’s no use exaggerating the threat either. But if any danger is present, it can be a good idea to be aware of it. And we'll try to help you figure that out.

Fake videos are common on video-sharing sites, and YouTube is no exception. Fraudsters upload thousands of clips with names featuring the titles of popular new films, TV shows and music albums, and links to these clips appear in search results. However, the videos prove to be completely unrelated to the respective titles except for, say, a link to a certain site where the content can supposedly be downloaded free of charge. Users will likely be required to enter their personal information in order to register or will be prompted to download a special codec to view the video. Need we tell you what’s lurking behind such prompts?

Some of our readers may smile condescendingly and say: "Big deal, I instantly realize it’s a scam and close these tabs almost before I open them. Well, some users do close them. But less experienced people can believe attackers, and once may be just enough. Imagine, for example, a child who desperately wants to see their favourite animated series. If they’re lucky, they’ll end up watching unrelated clips featuring familiar cartoon characters and catchy titles. According to view counters, millions of children searching the web run into them. If they’re less lucky, their parents may need to download Dr.Web LiveCD as soon as they get back home.

There also exist more peculiar threats. For example, ads that can be used to mount an attack. Of course, Google monitors ads on its sites, including YouTube. But, alas, sometimes something malicious will sneak in, albeit not for long. And although an attack involving ads embedded with JavaScript is as likely as winning a lottery, the consequences can be devastating.

By the way, are you certain the video you're watching is hosted specifically on YouTube?

In theory, a video clip itself can be dangerous, too. Certain video formats and players are known to have vulnerabilities. However, to exploit those, attackers need to lure users into downloading the clip and playing it on their machine using the corresponding player application. This danger is largely theoretical, but it is still frightening.

Answer: yes, it is possible!

Malicious code can be deployed using steganography or subtitles.