Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
blog.checkpoint.com
Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
1–10 of 234 posts
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#2This is the sourced post http://blog.checkpoint.com/2017/05/23/hacked-in-translation/
The ingenuity that goes into RCE exploits never ceases to amaze (and terrify) me. Can't wait for more details to be released.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#3Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#4Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
Can confirm the same on Windows. I downloaded the newest version manually as well.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#5> The attack vector relies heavily on the poor state of security in the way various media players process subtitle files and the large number of subtitle formats.
Well, last years exploits against iOS, Android and Ubuntu where all related to media metadata processing. It is only natural that the same folks screw up this one too.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#6What about mpv? That's my preferred video player.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#7Kodi 17.2 with the fix for this flaw has now been released:
https://kodi.tv/article/kodi-v172-minor-bug-fix-and-security...
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#8Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on.
There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subtitles on top of the video it's the same.
I wish a fraction of the energy we put into DRM would go into sandboxing instead.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#9These are the VLC commits adressing the issue:
https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#10Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
Same here. It appears to check http://update.videolan.org/vlc/sparkle/vlc-intel64.xml for updates and the newest version listed there is 2.2.4