Slashdot Mirror
Malicious Subtitles Threaten VLC, Kodi and Popcorn Time Users, Researchers Warn (torrentfreak.com)
Millions of people risk having their devices and systems compromised by malicious subtitles, according to a new research published by security firm Check Point. The threat comes from a previously undocumented vulnerability which affects users of popular streaming software, including Kodi, Popcorn-Time, and VLC. Developers of the applications have already applied fixes and in some cases, working on it. From a report: While most subtitle makers do no harm, it appears that those with malicious intent can exploit these popular streaming applications to penetrate the devices and systems of these users. Researchers from Check Point, who uncovered the problem, describe the subtitle 'attack vector' as the most widespread, easily accessed and zero-resistance vulnerability that has been reported in recent years. "By conducting attacks through subtitles, hackers can take complete control over any device running them. From this point on, the attacker can do whatever he wants with the victim's machine, whether it is a PC, a smart TV, or a mobile device," they write.
If it can be abused, then someone will do it. Why is it so difficult for developers to learn this?
Who didn't freaking use a strnlen on subtitles?!
How on earth does one design a plain-text subtitle system capable of being instructed to execute code?
Those subtitles will get you every time.
What does this have to do with anything?
I have bought a number of movies during the years, most of which did not have a readily-available Romanian subtitle at release. My wife doesn't speak English but understands it to some extent, the threshold being thick accents. Try to watch "Snatch" without subtitles, even in English, and you'll understand. "Doo ya leik dags?"
I have a bunch of movies on DVDs which I can enjoy but she can't, so I either rip them to HDD or download the same movie online, then attach a subtitle to it. Now we can both enjoy the movie at its fullest.
What I am doing is not piracy by any means, it's an extension of already existing features which I legally own the right to use.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
See https://kodi.tv/article/kodi-v...
"Zis tabakonist is scratched. I weel not buy eet."
"My hovercraft is full of eels. Do you want to come back to my place, bouncy-bouncy?"
Of course, it's the German gag dub that's the real killer: "Wenn ist das Nunnstuck, git und Slotermayer..."
If you want to ensure that you don't fall victim to these vulnerabilities, there's an easy way to be sure you're safe. Don't break the law by pirating content and software. If you refrain from piracy, you will be safe. Hope that helps.
You are quite wrong, on all accounts.
I download spanish subtitles for movies we've legally purchase all the time, because they did not come with those subtitles. So, you are wrong about legal purchases negating the need for these subtitles.
I've also gotten computer viruses from legally purchased and authentic software. Got one from a game I bought at Gamestop, back when games came on floppies. Anti-virus caught it as soon as the disk went into the drive. So, you are wrong about legal purchases keeping you safe.
Remember Sony's root kit debacle? Sometimes you're not safe from the corporation you're buying from.
My karma is in a nose dive
The only reason I would ever need a 3rd party sub file is if the original publisher was too cheap to include one or too incompetent to include a good one.
A Pirate and a Puritan look the same on a balance sheet.
It's a user controlled format that allows for the preservation of works that even the publisher wants suppressed. There are a number of things that simply aren't available from streaming services. Some publishers/services like to "expire" things or "put them in the vault".
A user controlled format avoids any of that.
A Pirate and a Puritan look the same on a balance sheet.
Did you never watch Mystery Science Theater 3000?
Last month I recorded a video of William Shatner telling the story about the biycle at Silicon Valley Comic Con 2017. I left my external mic at home, so the audio quality wasn't great. I paid $5 to Rev to create the captions and upload directly to my YouTube video. Nice service. I wonder if my videos could get malicious captions that way.
If you refrain from piracy, you will be safe.
Yes, you are so right!
Oh wait... Poe's law, right?
“He’s not deformed, he’s just drunk!”
I think it's a stretch to say that every user of Linux is reviewing the kernel source. I know that I use it regularly and I'm not a coder, just a networking geek. I *have* the source, but other than a very high-level understanding of what it purports to do, I really have no idea what the code actually does.
Have gnu, will travel.
AC is being sarcastic. For the willfully ignorant/forgetful out there
You're
still
not
safe.
Playing devils advocate here, but - you are supposed to wait for a region locked spanish version to b e released. No one knows when or for how long it will be available for any given title, and you have to pay again for the privilege.
Silence is a state of mime.
If you refrained from piracy, your Commodore 64's drive would need repair much more frequently because an anti-piracy measure involves reading "bad" sectors and causing the hard drive to knock at sector 0 (and thus misalign the head.)
If you refrain from piracy, you get a free rootkit while you play games such as Street Fighter V.
If you refrain from piracy in the future... well, I'm uncertain what will happen on the technical side, but you won't be able to purchase Alan Wake if you missed the recent fire sale.
I'm not advocating piracy, but the current situation is that anti-piracy mechanisms don't exactly respect the customer, or those that want to buy the products.
I use Kodi and VLC on Linux desktop boxes. The original publication talks about PC, Android and Smart TVs but I doubt someone can get full access to my machines without my consent with this exploit.
And, if you ever lose your hearing, as I did in the US Navy, you'll find subtitles to be a necessity. I hope you're not claustrophobic, you'd go crazy in that closed little mind of yours.
... is full of eels.
Mexico is region one. I'm in the US, in a household of all US citizens, but a household of majority spanish speakers. So, only region one media and players are available to us.
My karma is in a nose dive
As a non-native English speaker, the subtitles, whereas not really necessary, do come in handy.
So it sounds like you are likely to need a third party sub file.
Faster! Faster! Faster would be better!
I thought Mexico was region 4, like Brazil. o.o;
-uso.
What you hear in the ear, preach from the rooftop Matthew 10.27b
Don't break the law by pirating content and software.
There's nothing illegal about downloading subtitles for a movie.
Doo ya leik dags
To be fair, the immediate line following this one is: "Oh you mean dogs!"
It's kind of like in the Assassins Creed movies in one of the scenes it all sounds a bit like gibberish, but if you turn on subtitles you're greeted with the wonderful subtitle: (man speaking Spanish backwards) as if that was at all relevant.
But yes I do understand what you mean. I also watch native movies with subtitles because reading cuts through accents.
you are supposed to wait for a region locked spanish version to b e released
What region? Blurays Region A covers all of North and South America. Is every product in the USA supposed to have a Spanish subtitle?
There's only 3 regions if you're not buy 20 year old obsolete media.
Brazil is also Region 1 on Bluray. All American continents are.
I use to make some nice coin re-aligning 1541 drives since I had an o-scope to find the cat's eye.
-- I have a private email server in my basement.
So it looks like they're simply getting the IP address of the downloader and running VLC client against it. Is there any actual code in the file, or do they simply hope the user is running VLC server without password?
war4peace, you can mitigate issues by running Kodi on a Raspberry Pi. They cost about $100, but can run as an independent media server right next to your TV. They include wifi so cabling will not be an issue. This will isolate security problems from your laptop or PC that you may be using now. So infections will not effect your personal computer documents.
You can also set your router to isolate your raspberry Pi to a separate network from the one you use for computers, laptops and phones. This way a complete infection of your pi due to poor Kodi security will not effect any of your personal devices or monitor your network traffic.
The pi runs on SD cards with no hard drive, so if the system is compromised, you can simply wipe the SD card and reinstall. The process takes about 1 hour.
disclaimer: I am not a raspberry pi seller, but I am a big time buyer.
Is it capable of transcoding 4K bluray-quality H.265 to 1080p without stuttering? I'm yet to find a non-PC device capable of doing so. The Thecus N5810 came close (1080p only though) but no cigar.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)