If Popcorn Time renders all subtitles as HTML, would an exploit work if the subtitles were embedded in video container? Seed latest hit on Pirate Bay, root a lot of boxes. Yikes.
Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
161–170 of 234 posts
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#162Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
The update will be deployed today or tomorrow in the updaters.
Is that a default behavior or something you chose to do?
What if there's a bigger security fix you need to push to people asap?
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#163Speaking of Popcorn Time, last I heard there were a couple of forks and doubts about the safety of each and every one.
Is there any more clarity around the situation now?
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#164Earlier quoted context omitted.
Look at FFmpeg and all the multimedia libraries and you will be horrified.
vlc has a bug and yet you talk shit about well developed and fuzzed by google projects. thats why vlc will never be better than mpv.
FFmpeg, VLC, MPlayer, libdvd*, libxvid, x264, libflac, libvorbis and all the other have multimedia library codebases started in the late 90s/early 2000. Noone cared much about security at that times.
All those projects are under-funded, done by volunteers, on countless platforms, doing very low-level stuff, and supporting many formats.
This has nothing to do with one project or another.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#165Earlier quoted context omitted.
The update will be deployed today or tomorrow in the updaters.
Is that a default behavior or something you chose to do? What if there's a bigger security fix you need to push to people asap?
It is something that we chose to do.
We usually let between 24hours and a few days before doing an upgrade, seeing the possible regressions.
From tag to release to updates can take only 4hours, if we want enough mirrors.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#166These exploits will go nowhere without a catchy name ala HEARTBLEED...
I vote for SUB-DURAL HEMATOMA
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#167Treat data as data. Taking the Subrip format as an example, everything starts out fine so long as there is good bounds checking on the purely textual data. Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. The unnecessary complexity increase the poten…
> Then, however, some dipshit decides to extend the format by adding tags for things like bold, italics, underline etc. This is completely unnecessary for subtitles because the emphasis can be inferred from the dialogue. Emphasis of an entire line can be inferred, but how can emphasis within a line be inferred when you don't know which utterances within the line correspond to which words in the subtitles (which, if y…
> (which, if you need subtitles because you don't know the language being spoken, you won't)?
Or even more extreme, if you need subtitles because you are deaf.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#168Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…
Video players are among the most difficult of applications to sandbox. The codecs involved may be in-app software or hardware reached via one of a dozen abstraction APIs. The same is true for audio and frame buffer access. There is a huge amount of code that needs holes poked in the sandbox walls to function.
And realistically once you do that you have another component out there with all that complexity and permissions to exploit. That's exactly what happened with Android. The apps have a clean sandbox, so all the exploits target the mediaserver process instead.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#169Earlier quoted context omitted.
But you need to pass data from the access to the stream_filter, from the stream_filter to the demuxer, from the demuxer to several decoders, from the decoders to potentially a few video-filters and chroma-converters, and then finally to the output. Each of them need different access policies, and several of them require FS access. The last part is just one of the issues, very far from all of them. Seriously, stop thi…
These shouldn't require IPC at GB/s speed either. Modern sandboxes, like the one in Chrome, have a broker process which can open filesystem objects, device objects and sockets (file descriptors or handles) and pass them to a sandboxed decoder/renderer process, so there would be no need to stream filesystem data to the sandbox when the sandbox could do the file I/O itself. Even for Matroska ordered chapters, where the…
> I understand that retrofitting an existing program to use a multi-process sandboxing model is far from easy, and I'm definitely not volunteering to do it,
Yes, that's the core of the issue.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#170Earlier quoted context omitted.
At least SRT files are a purely declarative sequence of lines with "time time text".
"Officially", SRT files are only timecodes and text, but most players support html codes directly like to support more formatting options than the basic SRT. I wonder if some of them simply render the text as html and could be vulnerable to similar attacks. I say "Officially" because SRT has no standard, it just evolved through usage and it's a fucking mess, as I'm a software dev working on a subtitling editor softwa…
I seen a similar problem in another context where a browser engine is used to render some simple HTML in an app for convenience, but then suddenly turns into something exploitable because nobody is thinking about updating the engine when a bug is found in an esoteric (for the app) feature.
Embedded web engines should probably have a minimalistic safe mode.