Slashdot Mirror
Malicious Subtitles Threaten VLC, Kodi and Popcorn Time Users, Researchers Warn (torrentfreak.com)
Millions of people risk having their devices and systems compromised by malicious subtitles, according to a new research published by security firm Check Point. The threat comes from a previously undocumented vulnerability which affects users of popular streaming software, including Kodi, Popcorn-Time, and VLC. Developers of the applications have already applied fixes and in some cases, working on it. From a report: While most subtitle makers do no harm, it appears that those with malicious intent can exploit these popular streaming applications to penetrate the devices and systems of these users. Researchers from Check Point, who uncovered the problem, describe the subtitle 'attack vector' as the most widespread, easily accessed and zero-resistance vulnerability that has been reported in recent years. "By conducting attacks through subtitles, hackers can take complete control over any device running them. From this point on, the attacker can do whatever he wants with the victim's machine, whether it is a PC, a smart TV, or a mobile device," they write.
If it can be abused, then someone will do it. Why is it so difficult for developers to learn this?
Who didn't freaking use a strnlen on subtitles?!
If you want to ensure that you don't fall victim to these vulnerabilities, there's an easy way to be sure you're safe. Don't break the law by pirating content and software. If you refrain from piracy, you will be safe. Hope that helps.
How on earth does one design a plain-text subtitle system capable of being instructed to execute code?
Those subtitles will get you every time.
But the clueless will continue to be had but those with evil intent. I am not talking about Republicans. I am talking about their owners, the Russians. Putin's Russians.
That's how.
I don't understand. If I create a backup of my DVD and watch it using my Kodi box, how does someone inject malicious code into the subtitles? Oh, you mean this only happens when I acquire questionably legal content from an unknown source? Nevermind then.
See https://kodi.tv/article/kodi-v...
Using open source is not fraught with peril. There are so many people reviewing the code that bugs get fixed extremely quickly. There are about 7 billion people in the world today, and about 2% of them run Linux on the desktop. That is about 140 million users, and therefore, 140 million people reviewing the source code of the Linux kernel. That dwarfs any kind of quality control done by Microsoft or any other company, and by several orders magnitude. Given that the Linux kernel source code is reviewed by at least 140 million people, it's virtually impossible for bugs to go undetected in the Linux kernel. When you consider the use of Linux on servers, it's extremely likely that well over 140 million people are reviewing the source code to the kernel. I have proven you completely wrong. Would you like to retract your statement?
"Zis tabakonist is scratched. I weel not buy eet."
"My hovercraft is full of eels. Do you want to come back to my place, bouncy-bouncy?"
Of course, it's the German gag dub that's the real killer: "Wenn ist das Nunnstuck, git und Slotermayer..."
That is why we have Firejail, at least on Linux.
They've been holding 3.0 hostage for years. I'd sure love WebVTT subtitle support already!
I could not find any tracking label(s) for this series of issues... No CVEs or equivalent, or even a reference to taling to CERT... which is kinda lame since the vulnerability notice came from Checkpoint.
So, how I am I supposed to look into Debian, RedHat, SuSE or Ubuntu security trackers to check if they have updated packages for this *group* of vulnerabilities?
Did anyone find a separate post from Checkpoint or some other project with an universal ID of some sort for these bugs?
Did you never watch Mystery Science Theater 3000?
Last month I recorded a video of William Shatner telling the story about the biycle at Silicon Valley Comic Con 2017. I left my external mic at home, so the audio quality wasn't great. I paid $5 to Rev to create the captions and upload directly to my YouTube video. Nice service. I wonder if my videos could get malicious captions that way.
I think it's a stretch to say that every user of Linux is reviewing the kernel source. I know that I use it regularly and I'm not a coder, just a networking geek. I *have* the source, but other than a very high-level understanding of what it purports to do, I really have no idea what the code actually does.
Have gnu, will travel.
if I wanted to read, i'll read a book, you know, without pictures or video.
I use Kodi and VLC on Linux desktop boxes. The original publication talks about PC, Android and Smart TVs but I doubt someone can get full access to my machines without my consent with this exploit.
... is full of eels.
These infected malicious subtitles are hitting You Tube already.
Look what did to this. Way too long and not funny at all!
TAIA?
Clearly the best fix here is a new standard for captioning/subtitles implemented in JSON. If that can solve all our RSS issues, it can solve anything!
So it looks like they're simply getting the IP address of the downloader and running VLC client against it. Is there any actual code in the file, or do they simply hope the user is running VLC server without password?
Doesn't tell what the vulnerability is at all.