Internet Security and Programming

A flaw in Apple’s QuickTime file format could allow spyware to be downloaded to collect personal information from users. According to Didier Stevens, who works as an independent security researcher, the flaw can allow a QuickTime movie to execute a piece of Javascript code that in turn downloads spyware onto a victim’s computer. He said that at present a French rock band is using the technique to find out information about users visiting the band’s MySpace page. On the page is embedded an invisible QuickTime video which uses the software’s HREF function to run the script.

Read more…