Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

blog.checkpoint.com

Post reply on HN
Print view View original

141–150 of 234 posts

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#141

Post by rocqua »

tomp wrote: post #105
MereInterest wrote: post #26

Earlier quoted context omitted.

I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.

Well, M$ Office makes sense, since it's macros. What I really don't understand is Acrobat Reader. It has a "Protected View", which is the first WTF - .pdf-s are read-only, so there should be absolutely zero active code running anyways. What's the next, much bigger WTF WTF WTF is that you need to exit protected view to print the document . How can the program read and render the document on screen, but not print it?!…

PDF is a very fancy wrapper around post-script (massive over-simplification). Post script is a Turing complete language. As such, PDF is essentially code.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#142

Post by fulafel »

jbk wrote: post #22
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

Ha, the famous sandboxing remark. I wish it was that simple! So, let me share some light on the sandboxing for multimedia (I work on VLC). If you sandbox an application like VLC, in the current way of doing sandboxing, which we've done for macOS, WinRT/UWP, and snaps, you still need a lot of permissions. Namely: - you need to be able to open files without user interactions (no file picker), in order to open playlist,…

You don't need special fast IPC. Even uncompressed video is fine over standard IPC.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#143

Post by AdmiralAsshat »

ConfucianNardin wrote: post #23

Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…

Thanks for that. I read the article and was really confused at first. I don't do a whole lot of video editing, but I've opened up a .srt file a handful of times and noticed that it was nothing more than timestamps and text. The fact that the article made it seem like this was some kind of universal vulnerability made me wonder, "A simple subtitle file should be opened in read-only mode. Are these programs just reading whatever is in the .srt file and EXECUTING it!?!" That would be beyond horrible.

The fact that it's multiple, independent vulnerabilities makes me feel a little better. I've used Kodi and OpenSubtitles before while watching a movie to search and download subs for the movie without ever leaving Kodi. When it works, it's nothing short of magical.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#144

Post by Khao »

marcosdumay wrote: post #77
cesarb wrote: post #71

Earlier quoted context omitted.

AFAIK, fonts aren't a passive format, they contain code which executes in a VM.

At least SRT files are a purely declarative sequence of lines with "time time text".

"Officially", SRT files are only timecodes and text, but most players support html codes directly like to support more formatting options than the basic SRT. I wonder if some of them simply render the text as html and could be vulnerable to similar attacks. I say "Officially" because SRT has no standard, it just evolved through usage and it's a fucking mess, as I'm a software dev working on a subtitling editor software.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#145

Post by DenisM »

phkahler wrote: post #138
DenisM wrote: post #48

Earlier quoted context omitted.

Sarcasm can feel good, but it poisons the well of civilized discussion. Kindly refrain.

The original comment to rewrite VLC in rust was mostly sarcasm. Sure, if every app and library was rewritten in rust without using the unsafe features, we'd see a lot fewer of these kinds of bugs. But it's going to be a long long time before we live in that kind of world. That doesn't mean people can't start today - imagine if the top 5 codecs were written in a safe language, then they could warn users about "less sa…

So? Replying to sarcasm with more sarcasm makes things worse yet. It's still wrong.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#146

Post by ahakki »

ackfoo wrote: post #93

Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…

For certain films it can be vital that subtitles can be styled in multiple ways.

For example: I recently watched the movie "The Handmaiden" which includes both spoken Korean and Japanese. The language the characters speak in any given situation is relevant to the story. If all the subtitles were the same I would not have noticed this destinction.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#147

Post by Mister_Snuggles »

simias wrote: post #115
captainmuon wrote: post #8

Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…

I don't understand why sandboxing the userland is not a thing on the linux desktop at least. When you sanely configure a un*x server you generally at least create a user per application. The web server runs as www, the database with its own user, the ssh process runs as the logged-in user (the daemon runs as root obviously, but only for just as long as it needs before forking a less priviledged child) etc... But when…

> Maybe we've just been doing it wrong the entire time and we should just log into our single-user desktop computers as root and then spawn our shells and other applications as various unpriviledged users as necessary (this could easily be scripted in launcher scripts). I wonder if anybody has attempted to do that, but again I don't expect that Xorg would work very well in this configuration.

Replace '...as various unprivileged users' with '...as completely isolated virtual machines' and you've got the gist of what QubesOS does. I haven't tried it personally, but it sounds really interesting.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#148

Post by bingojess »

tydok wrote: post #117
bingojess wrote: post #103

Earlier quoted context omitted.

I believe it just scrapes them all. I can't remember the last time opensubtitles didn't have a sub I was looking for

Perhaps the most difficult problem is to find a subtitle in multiple languages.

True I have only needed English subs

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#149

Post by Khao »

ackfoo wrote: post #93

Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…

Formatting really adds a lot of depth that is important for deaf/hard of hearing people. Maybe you should try thinking about people with disabilities some time.

Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

#150

Post by zer0tonin »

adrianN wrote: post #134
simias wrote: post #115

Earlier quoted context omitted.

I don't understand why sandboxing the userland is not a thing on the linux desktop at least. When you sanely configure a un*x server you generally at least create a user per application. The web server runs as www, the database with its own user, the ssh process runs as the logged-in user (the daemon runs as root obviously, but only for just as long as it needs before forking a less priviledged child) etc... But when…

Maybe you'll like QubesOS.

QubesOS, while being a very interesting project, is much more extreme that running different application as different users.
Post reply on HN