Important: Uninstall QuickTime for Windows

Summary

This blog post, "Important: Uninstall QuickTime for Windows", is a blueAPACHE article from 2016 covering security. Apple’s QuickTime used to be a common install for many Windows users – thanks mostly to iTunes – but it has been a long time since it was a prerequisite for playing video and audio files on Windows-based computers. It is written for readers evaluating emPOWER Security. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

Apple’s QuickTime used to be a common install for many Windows users – thanks mostly to iTunes – but it has been a long time since it was a prerequisite for playing video and audio files on Windows-based computers. In recent days, Trend Micro discovered two critical flaws in the Windows build of QuickTime and reported them to Apple. Apple responded to Trend Micro explaining that they won’t be fixing the bugs, said they were no longer supporting it, and recommended uninstalling QuickTime for Windows. Christopher Budd from Trend Micro stated “Apple is deprecating QuickTime for Microsoft Windows. They will no longer be issuing security updates for the product on the Windows Platform and recommend users uninstall it. Note that this does not apply to QuickTime on Mac OSX.” Apple began winding down support for QuickTime 7 on Windows in 2013 when the stopped offering tools to third-party developers. The last update for Windows was some nine months ago, and in January this year, they removed QuickTime browser plug-ins on Windows. However, there appears to have been no general warning to users that support is being dropped. The vulnerabilities identified – ZDI-16-241 and ZDI-16-242 – are heap-corruption-based remote code execution vulnerabilities. They allow a hacker to hijack a victim’s computer and infect it with malware, simply by tricking them into opening a malicious file or web download. Budd explained that they were not aware of any attacks that had taken advantage of the QuickTime weaknesses, but the best defence was to follows Apple’s own advice and uninstall the programs from Windows-powered machines. The US Computer Security Readiness Team (CERT) – part of the US Department of Homeland Security – agrees. Following Trend Micro’s findings, CERT issued an alert advising Windows users to immediately uninstall QuickTime. Organisations can mitigate the risks associated with obsolete software by implementing a Standard Operating Environment (SOE) across the organisation. SOE is a standard implementation of an operating system and its associated software. Combined with the correct policies, employees can be restricted in what they can, and can not, install. You can find information on how to uninstall QuickTime for Windows from the Apple website at https://support.apple.com/HT205771. For more information, contact the blueAPACHE account team.

Related

• emPOWER Security
• emPOWER Security (pillar hub)
• emPOWER Microsoft Practice (pillar hub)

Frequently asked questions

Which two vulnerabilities did Trend Micro discover in QuickTime for Windows, per this article?

ZDI-16-241 and ZDI-16-242, described as heap-corruption-based remote code execution vulnerabilities that could let a hacker hijack a victim's computer via a malicious file or web download.

Who from Trend Micro is quoted explaining Apple's decision, and what did they say?

Christopher Budd, who stated Apple is deprecating QuickTime for Microsoft Windows, will no longer issue security updates for it on Windows, and recommends users uninstall it (this does not apply to QuickTime on Mac OSX).

When did Apple begin winding down support for QuickTime 7 on Windows, according to the article?

In 2013, when Apple stopped offering tools to third-party developers; the last Windows update was about nine months before this article, and QuickTime browser plug-ins on Windows were removed in January of the article's year.

Which US agency issued an alert advising Windows users to uninstall QuickTime, per this article?

US-CERT (the US Computer Security Readiness Team), part of the US Department of Homeland Security, following Trend Micro's findings.

Were there any known attacks exploiting the QuickTime vulnerabilities at the time of this article?

No, Budd said Trend Micro was not aware of any attacks taking advantage of the QuickTime weaknesses, but recommended uninstalling as the best defence regardless.

What mitigation strategy does the article recommend for organisations dealing with obsolete software generally?

Implementing a Standard Operating Environment (SOE) across the organisation, combined with policies restricting what employees can and cannot install.

Where does the article direct readers to find instructions for uninstalling QuickTime for Windows?

The Apple support website at support.apple.com/HT205771.

What was QuickTime for Windows historically bundled with, according to the article?

iTunes, described as the main reason QuickTime used to be a common install for Windows users, despite no longer being a prerequisite for playing video and audio files.

Source

• origin post (2016)

Knowledge Base