Slightly related to this: where can I find data sanitizers for common file formats (PDF, MP3 and so on)?
what counts as sanitizing? How do you know a file is malicious?
Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
51–60 of 234 posts
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#52Earlier quoted context omitted.
> Not even multi-process. Threads on Linux can have their own seccomp profiles. Feels kinda pointless, since all threads in a process share the same memory protection.
They don't have to. Clone can do a lot of magic without full processes.
But then you need to copy the memory from the decoder to the video output or you get back to the same problem to work-on.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#53Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…
Moving 4K / 10-bit buffers at 30 or 60 fps (because 3D) between processes is not as easy as it sounds.
Both Windows and OS X provide ways for a sandboxed process to draw directly to a GPU-resident texture owned by another process. Chrome's renderer sandbox is a good example of this technique.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#54Earlier quoted context omitted.
The main VLC developer is an amazing programmer. But if he uses his time to shave cycles off some SIMD decoding algorithm then boring things like file processing is done by random jr. developer. The problem is that boring stuff can also be very security sensitive.
You are more than welcome to contribute and since you have a very strong opinion it seems you know your stuff, so go for it, nobody is charging a dime to work there in any case.
> you have a very strong opinion it
Yes I do, this is internet after all!
> seems you know your stuff,
Now you lost me :)
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#55Earlier quoted context omitted.
Holy crap, that code doesn't look good. I predict we will see more exploits for this project. Maybe we should stop random people from contributing to complex C projects?
Look at FFmpeg and all the multimedia libraries and you will be horrified.
I thought they cleaned up after the last round of exploits?
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#56Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…
I get equally confused anytime Microsoft Office gives the "Files from the internet may contain viruses." warning. How do you mess up a document editor so badly that the document can affect the computer? I know that the answer is Visual Basic, and I know that there are legacy reasons why it will never be removed, but holy cow, it is ridiculous.
Please don't fall into the Dunning-Kruger[0] trap by assuming a straightforward task is also easy to perform. These things may very well be complex and include aspects that are not immediately obvious. And even if they don't, even simple code executing simple tasks can be vulnerable to bugs or flawed reasoning without the authors (or tooling) being stupid or naive.
[0]: https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#57Slightly related to this: where can I find data sanitizers for common file formats (PDF, MP3 and so on)?
what counts as sanitizing? How do you know a file is malicious?
Read data according to spec, drop stuff that is incorrect and write it back.
For example if MP3 genre field is 999 bytes long cut it down to 32 bytes.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#58Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…
Ha, the famous sandboxing remark. I wish it was that simple! So, let me share some light on the sandboxing for multimedia (I work on VLC). If you sandbox an application like VLC, in the current way of doing sandboxing, which we've done for macOS, WinRT/UWP, and snaps, you still need a lot of permissions. Namely: - you need to be able to open files without user interactions (no file picker), in order to open playlist,…
> Probably do a multi-process media player, like Chrome is doing, with parsers and demuxers in a different process, and different ones for decoders and renderers. Knowing that you probably need to IPC several Gb/s between them.
That's not actually how Chrome's renderer sandboxing works. Both Windows and OS X allow you to share a GPU-resident texture between processes (DXGI shared surfaces and IOSurface respectively), so there's no need to copy any video data.
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#59Wow, that is bad. I'm always amazed by such vectors in supposedly passive formats, like fonts, images, and so on. There is no excuse that these kind of applications are not completely sandboxed. All you need is some kind of DLL, raw data in, raw pixels out. In case of hardware accelerated codecs, raw pixels in, surface pointer in, nothing out. There is no need to be able to access the filesystem, etc.. To render subt…
Ha, the famous sandboxing remark. I wish it was that simple! So, let me share some light on the sandboxing for multimedia (I work on VLC). If you sandbox an application like VLC, in the current way of doing sandboxing, which we've done for macOS, WinRT/UWP, and snaps, you still need a lot of permissions. Namely: - you need to be able to open files without user interactions (no file picker), in order to open playlist,…
Interesting.
I am only interested in these features:
- you need access to the GPU stack, which is running in kernel-mode, btw, to output video and get hw acceleration;
- you need access to the audio stack, also in low-level mode;
- you need access to the DSP acceleration (not always the GPU);
- you need access to the system settings to disable screensavers, and adjust brightness;
- you need to unzip, untar, decrypt, decipher and so on;
- many OpenGL client libraries need access to the /etc too;
Is there a lighter version where these features are cut?
- you need to be able to open files without user interactions (no file picker), in order to open playlist, MXF or MKV files;
- you need the same if ever you have a database of files (media center oriented);
- you need raw access to /dev/* to play DVD, CD and other optical disk (and the equivalent on Windows);
- you need ioctl on such devices, to pass the MMC for DVD/Bluray;
- you need raw access to /dev/v4l* for your webcams and be able to control them;
- on linux, you have access to x11 for the 3 above features, which is almost root;
- you need access to /etc/ (registry) for proxy informations, fonts configuration and accessibility;
- you need access to the network, as input and output (think remote control);
- you need access to mounts to be able to see the insertion of DVD/Bluray/USB/SD cards and such;
- you need to expose an IPC (think MPRIS on Linux);
- you need access to the fonts and the fonts configuration (see fontconfig).
Re: Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users
#60Earlier quoted context omitted.
Moving 4K / 10-bit buffers at 30 or 60 fps (because 3D) between processes is not as easy as it sounds.
Both Windows and OS X provide ways for a sandboxed process to draw directly to a GPU-resident texture owned by another process. Chrome's renderer sandbox is a good example of this technique.
Sure, but then you need a multi-process sandbox, and it's not easy to do.
And the performance is not easy to obtain.