Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

blog.checkpoint.com

Post reply on HN
Print view View original

71–80 of 234 posts

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#71

Post by cesarb »

captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

AFAIK, fonts aren't a passive format, they contain code which executes in a VM.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#72

Post by johncolanduoni »

jbk wrote: post #60
johncolanduoni wrote: post #53

Earlier quoted context omitted.

Both Windows and OS X provide ways for a sandboxed process to draw directly to a GPU-resident texture owned by another process. Chrome's renderer sandbox is a good example of this technique.

Sure, but then you need a multi-process sandbox, and it's not easy to do. And the performance is not easy to obtain.

You can co-opt Chromium's. I've been doing that with a project I'm working on and it has worked quite well.

I'm also not sure where you'd lose much performance. If you hand the file handles/sockets and backbuffer to the renderer, you only need enough IPC to synchronize the drawing. Sending small messages on the order of 100 times per second between processes is not going to be a bottleneck.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#73

Post by thirdsun »

jbverschoor wrote: post #64
jbk wrote: post #22

Earlier quoted context omitted.

Ha, the famous sandboxing remark. I wish it was that simple! So, let me share some light on the sandboxing for multimedia (I work on VLC). If you sandbox an application like VLC, in the current way of doing sandboxing, which we've done for macOS, WinRT/UWP, and snaps, you still need a lot of permissions. Namely: - you need to be able to open files without user interactions (no file picker), in order to open playlist,…

You actually don't NEED a lot of these things I'm perfectly fine with a default / embedded font. I don't have an optical drive A database can be in the local app storage. I'm fine opening a subtitle file myself. Why would I need IPC? Why would I need to unzip anything? If it's subtitle files, it can be done in-memory. Are you sure we need low-level audio? I don't have a remote, so I'd like it to be disabled by defaul…

That's you. Most users expect one or more of the other mentioned features.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#74

Post by Filligree »

jbk wrote: post #52
viraptor wrote: post #41

Earlier quoted context omitted.

They don't have to. Clone can do a lot of magic without full processes.

But then you need to copy the memory from the decoder to the video output or you get back to the same problem to work-on.

No, you can use a shared memory segment for a buffer just for that.

It's more coding, certainly, but it's possible. Security is an option if we wanted it.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#75

Post by innocenat »

bsandert wrote: post #56
MereInterest wrote: post #26

Earlier quoted context omitted.

I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.

Please don't fall into the Dunning-Kruger[0] trap by assuming a straightforward task is also easy to perform. These things may very well be complex and include aspects that are not immediately obvious. And even if they don't, even simple code executing simple tasks can be vulnerable to bugs or flawed reasoning without the authors (or tooling) being stupid or naive. [0]: https://en.wikipedia.org/wiki/Dunning%E2%80%93K…

And I find this especially true for anything media-related. I am amazed it even works for most user without problem [0]

[0] Obvious problems, like unplayable, etc. Minor problems (chroma placement error, transfer function, etc) seems to occur very frequently.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#76

Post by tydok »

etix wrote: post #66
kutkloon7 wrote: post #46

The thing that most amazes my about Popcorn Time is how they find the subtitles. It seems to succeed even when I can't find subtitles myself. More related to the article, you would think that subtitles are literally the easiest file format in existence to safely handle. It's incredibly well-defined in terms of textual data and times.

They use a hash function to match subtitles. http://trac.opensubtitles.org/projects/opensubtitles/wiki/Ha...

The problem isn't only about matching subtitles to movies but also where to look for subtitles, e.g. opensubtitles.org, subscene.com, etc.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#77

Post by marcosdumay »

cesarb wrote: post #71
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

AFAIK, fonts aren't a passive format, they contain code which executes in a VM.

At least SRT files are a purely declarative sequence of lines with "time time text".

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#78

Post by FranOntanaya »

kutkloon7 wrote: post #46

The thing that most amazes my about Popcorn Time is how they find the subtitles. It seems to succeed even when I can't find subtitles myself. More related to the article, you would think that subtitles are literally the easiest file format in existence to safely handle. It's incredibly well-defined in terms of textual data and times.

> literally the easiest file format in existence to safely handle.

Well, which one of them. There's nearly a hundred different subtitle formats, and each one has a whole set of variants. Just Timed Text alone (XML) can have more layouts than one could count, specially since it's meant to be able to replicate technically all previous industry formats.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#79

Post by jbk »

Filligree wrote: post #74
jbk wrote: post #52

Earlier quoted context omitted.

But then you need to copy the memory from the decoder to the video output or you get back to the same problem to work-on.

No, you can use a shared memory segment for a buffer just for that. It's more coding, certainly, but it's possible. Security is an option if we wanted it.

That's exactly the point above. See my above comment.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#80

Post by Tepix »

captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

"There is no excuse that these kind of applications are not completely sandboxed."

Woah, what a sense of entitlement! What's your excuse for not having submitted a patch years ago?

Post reply on HN