171–180 of 234 posts
Earlier quoted context omitted.
They use a hash function to match subtitles. http://trac.opensubtitles.org/projects/opensubtitles/wiki/Ha...
The problem isn't only about matching subtitles to movies but also where to look for subtitles, e.g. opensubtitles.org, subscene.com, etc.
I did security research on VLC on Windows a year or two ago. I may be remembering incorrectly, but last I recall every module was protected by ASLR. Which means that remote code execution is not likely because there is no scripting or network comms to dynamically create a valid ROP chain. I also didn't check for executable heaps at the time but given that all heaps are non executable (which they really shouldn't be e…
Having ASLR is not bullet proof to remote code execution, e.g. iOS has ASLR for a long time and can still be jailbroken (which usually involves a code injection etc). The key is info leak, e.g. if you somehow can reliably find the memory location of open() syscall, the memory location of the whole libc can be inferred, and libc is usually large enough to construct a ROP chain. (I haven't work in security area for a long time so correct me if I'm wrong).
The researcher unable to provide a POC for vlc could simply mean it's hard due to ASLR, but it's not impossible.
Also: I believe ASLR is a compiler option (with a supported OS), it should be relatively easy for Kodi and Popcorn Time to start using ASLR.
I did security research on VLC on Windows a year or two ago. I may be remembering incorrectly, but last I recall every module was protected by ASLR. Which means that remote code execution is not likely because there is no scripting or network comms to dynamically create a valid ROP chain. I also didn't check for executable heaps at the time but given that all heaps are non executable (which they really shouldn't be e…
Address space randomization is not "protection". It's a form of security by obscurity. The odds of an exploit working are reduced, at the expense of more crashes due to exploit failure.
It helps developers ignore bugs, since they can no longer reproduce them.
Earlier quoted context omitted.
> Maybe we've just been doing it wrong the entire time and we should just log into our single-user desktop computers as root and then spawn our shells and other applications as various unpriviledged users as necessary (this could easily be scripted in launcher scripts). I wonder if anybody has attempted to do that, but again I don't expect that Xorg would work very well in this configuration. Replace '...as various u…
Thanks to your and andrian's comment I'm currently downloading a QubeOS ISO, I'm curious to see how usable it is. Using VMs sound a bit more heavy handed than what I had in mind, but I guess on modern machines with good hardware support it should be pretty workable.
It's dockerized applications (as close as a VM as possible).
Interestingly running VLC 2.2.4 on MacOS 10.12 and checking for updates returns 'VLC 2.2.4 is currently the newest version available.', obviously I downloaded 2.2.5.1 from videolan.org but still odd.
Can confirm the same on Windows. I downloaded the newest version manually as well.
Earlier quoted context omitted.
The problem isn't only about matching subtitles to movies but also where to look for subtitles, e.g. opensubtitles.org, subscene.com, etc.
A great script: https://github.com/Diaoul/subliminal
Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…
I did security research on VLC on Windows a year or two ago. I may be remembering incorrectly, but last I recall every module was protected by ASLR. Which means that remote code execution is not likely because there is no scripting or network comms to dynamically create a valid ROP chain. I also didn't check for executable heaps at the time but given that all heaps are non executable (which they really shouldn't be e…
every module was protected by ASLR. Address space randomization is not "protection". It's a form of security by obscurity. The odds of an exploit working are reduced, at the expense of more crashes due to exploit failure. It helps developers ignore bugs, since they can no longer reproduce them.
Well, it would crash, so they can reproduce it, no?
I did security research on VLC on Windows a year or two ago. I may be remembering incorrectly, but last I recall every module was protected by ASLR. Which means that remote code execution is not likely because there is no scripting or network comms to dynamically create a valid ROP chain. I also didn't check for executable heaps at the time but given that all heaps are non executable (which they really shouldn't be e…
every module was protected by ASLR. Address space randomization is not "protection". It's a form of security by obscurity. The odds of an exploit working are reduced, at the expense of more crashes due to exploit failure. It helps developers ignore bugs, since they can no longer reproduce them.
"Only" security by obscurity is the best we can get in the c/++ world without compiling for a virtual machine.
Was annoying to find the details. Looks like PopcornTime was rendering subtitle text as HTML, inside their app (html/js-based), creating an XSS vector (looking at https://github.com/popcorn-official/popcorn-desktop/commit/a... , https://github.com/butterproject/butter-desktop/pull/602 ). Likely the javascript runtime they're using allows file access and execution of arbitrary executables, enabling the metasploit shel…
If only VLC had been re-written in rust this would never have happened. For shame.