Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

blog.checkpoint.com

Post reply on HN
Print view View original

131–140 of 234 posts

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#131

Post by simias »

leni536 wrote: post #129
simias wrote: post #115

Earlier quoted context omitted.

I don't understand why sandboxing the userland is not a thing on the linux desktop at least. When you sanely configure a un*x server you generally at least create a user per application. The web server runs as www, the database with its own user, the ssh process runs as the logged-in user (the daemon runs as root obviously, but only for just as long as it needs before forking a less priviledged child) etc... But when…

Well, there is firejail now. It does Xorg sandboxing through xpra, I don't know how it affects hardware acceleration though.

Oh that looks grand, thank you for pointing that out. I'll give it a try.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#132

Post by leni536 »

tomp wrote: post #105
MereInterest wrote: post #26

Earlier quoted context omitted.

I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.

Well, M$ Office makes sense, since it's macros. What I really don't understand is Acrobat Reader. It has a "Protected View", which is the first WTF - .pdf-s are read-only, so there should be absolutely zero active code running anyways. What's the next, much bigger WTF WTF WTF is that you need to exit protected view to print the document . How can the program read and render the document on screen, but not print it?!…

Javascript is part of the PDF standard (yeah...).

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#133

Post by izacus »

tomp wrote: post #105
MereInterest wrote: post #26

Earlier quoted context omitted.

I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.

Well, M$ Office makes sense, since it's macros. What I really don't understand is Acrobat Reader. It has a "Protected View", which is the first WTF - .pdf-s are read-only, so there should be absolutely zero active code running anyways. What's the next, much bigger WTF WTF WTF is that you need to exit protected view to print the document . How can the program read and render the document on screen, but not print it?!…

PDF can contain executable code (JavaScript to be exact), access remote URLs, and has several separate modes of display (which means that document rendered for printing is different than what you see on the screen).

PDF is an old complex format with a lot of features used in a lot of special cases that go light years beyond looking at a simple text file. It's the reason for all the issues, but keeping it useful as it is and magically waving away all issues is not really easy.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#134

Post by adrianN »

simias wrote: post #115
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

I don't understand why sandboxing the userland is not a thing on the linux desktop at least. When you sanely configure a un*x server you generally at least create a user per application. The web server runs as www, the database with its own user, the ssh process runs as the logged-in user (the daemon runs as root obviously, but only for just as long as it needs before forking a less priviledged child) etc... But when…

Maybe you'll like QubesOS.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#135

Post by phkahler »

kutkloon7 wrote: post #46

The thing that most amazes my about Popcorn Time is how they find the subtitles. It seems to succeed even when I can't find subtitles myself. More related to the article, you would think that subtitles are literally the easiest file format in existence to safely handle. It's incredibly well-defined in terms of textual data and times.

It seems subtitles aren't important enough to have reduced the number of formats. From reading the comments, it seems like the world would benefit from a single format with most capabilities and have everyone convert all files to that. Until then, we need players that understand everything.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#136

Post by aruggirello »

_jomo wrote: post #9

These are the VLC commits adressing the issue: https://github.com/videolan/vlc/search?utf8=%E2%9C%93&q=subt...

I don't seem to find a way to update VLC to 2.2.5 on Ubuntu (or Debian, or Mint for the matter). I understand Canonical does not provide updates in the repos - but the VideoLAN website's download URL for Ubuntu is just "apt://vlc" - it would be nice to be able to download one or more .deb's too.

Do we have to build it from source?

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#137

Post by mikeash »

airza wrote: post #107
pjmlp wrote: post #17

Earlier quoted context omitted.

As usual, the common set of friends we already know since the 80's: > Fix potential heap buffer overflow > Fix potential out of bound read > Fix invalid double increment.

i've never seen a double increment exploited before- it's undefined behavior, but what is the typical route against that?

The double increment itself isn't undefined behavior. Note that the two increments were separated with a semicolon, making them separate statements. It's equivalent to pzs_text += 2;.

The exploit would presumably involve structuring your data so that the excess increment skips over a terminator of some sort. If it's scanning until it hits a zero byte, and you get it to skip over the zero byte, then you have a buffer overflow.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#138

Post by phkahler »

DenisM wrote: post #48
aclsid wrote: post #39

Earlier quoted context omitted.

Yes, they clearly have the resources to do that. Maybe you can propose a prototype in Rust?

Sarcasm can feel good, but it poisons the well of civilized discussion. Kindly refrain.

The original comment to rewrite VLC in rust was mostly sarcasm. Sure, if every app and library was rewritten in rust without using the unsafe features, we'd see a lot fewer of these kinds of bugs. But it's going to be a long long time before we live in that kind of world. That doesn't mean people can't start today - imagine if the top 5 codecs were written in a safe language, then they could warn users about "less safe" content for anything else without pissing off too many users. Maybe. And that alone is a big job.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#139

Post by sigstoat »

ackfoo wrote: post #93

Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…

> Treat data as data.

That doesn't solve the problem. http://langsec.org/

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#140

Post by 3chelon »

MereInterest wrote: post #26
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.

Basically, regardless of VMs etc, parsing any kind of binary data is inherently dangerous. Old binary formats were bespoke, there weren't always standard libraries to read the headers etc, so everyone wrote their own, with their own bugs. A common attack vector was simply using invalid lengths on header fields, causing a stack or buffer overflow to fool the host into executing the binary data as code.

That's one of the reasons these days there's a tendency to use text-based representations like JSON, but of course anything size-sensitive such as images and movies is still generally binary.

Post reply on HN