Live data from Hacker News

Hacking YouTube with a MP4

realkeyboardwarrior.github.io

51–60 of 94 posts

Re: Hacking YouTube with a MP4

#51
post #2

What's the bug here? It looks like you fooled the container codec with a incorrect timecode and then when it was uploaded to YouTube, the file was rasterized into a sane format. I don't really see an attack here, nor do I see a mitigation.

The issue with "expensive to calculate" values like the duration of media (for example, variable encodings) is that the encoder tries to help others avoid rematerializing these values by saving its calculation in some metadata. The problem is consumers then have to "trust" the encoder; this post demonstrates a non-malicious case, but perhaps there are more malicious cases (like the vulnerability in Android's libstage…

> For example, I wrote an iTunes-in-the-browser web app; I needed to know durations of songs to display them. MP3 doesn't include these in metadata IIRC, so I needed to pre-process them with ffmpeg just to have duration data.

This jogged my memory from (part of) the first thing I ever built in a general purpose programming language, all of probably 20 years ago! I was doing exactly this: using ffmpeg to get duration metadata from MP3s.

My memory was fuzzy so I looked it up, which (surprisingly!) confirmed what I remembered. MP3s may include metadata (ID3) which may include duration (or start/end times).

I knew my input source (it was me, my music, my MP3 conversions), so I was able to rely on the metadata directly. IIRC I even processed it on demand in my first naive version, which was “slow” but not nearly as slow as stuff I’d complain about today.

Re: Hacking YouTube with a MP4

#53
post #52

Came across a video on YouTube recently that I think may be misreporting its length due to this issue: https://www.youtube.com/watch?v=5Grsvyt5xps The video is 22 minutes but it's reported at nearly 3 hours in length.

But OP's video is just a video with very low frame rate (reported as 0.030 FPS from `mediainfo`). There is nothing broken about it.

Just become its file size is small, does not mean it can't be 15 hours long (one of the author is takeaway is "[t]he size of a video file is not an proper indicator for how long it is": but even without this hack, you can't do that either, since video can have whatever bitrates.)

Re: Hacking YouTube with a MP4

#54

One of my favorite "breaking YouTube" (jpeg, really) demos was the slow motion glitter https://youtu.be/BtYKDamqo2I

I spent time skipping back and forth in the video looking for the side by side(raw vs yt) until it dawned on me. I may in fact be an idiot.

Re: Hacking YouTube with a MP4

#55
post #52

Came across a video on YouTube recently that I think may be misreporting its length due to this issue: https://www.youtube.com/watch?v=5Grsvyt5xps The video is 22 minutes but it's reported at nearly 3 hours in length.

I saw this one misreported as 22 minutes in Firefox and Discord. Only 1:43 ? in reality https://www.youtube.com/watch?v=RerbrfVd1nI

> Herbie Hancock on Miles: Don't play the butter notes!

Re: Hacking YouTube with a MP4

#56
post #13

Earlier quoted context omitted.

We don't transcode video, so no.

I presume you're Discord eng. You must do some sort of pass or parse of it, because every now and then I'll upload something and it will fail to process and result in what I'll call "the sad Discord poop"…

We try to grab the first frame to show a preview. But if we can't for whatever reason, that's when the sad poop appears :(

Re: Hacking YouTube with a MP4

#57

It's almost like we didn't learn from the days of MP3. I have several MP3s that, in certain players, are like a half hour long, despite being only 2 minutes long. My best guess was that they were assumed to be CBR, despite nothing about MP3 implying CBR… (there's not a flag or anything that says "this is a VBR" file, CBR files are just special…) Nowadays it's mostly moot since MP3 is obsolete.

> MP3 is obsolete

What should we be using instead for lossy audio?

Re: Hacking YouTube with a MP4

#58
post #6

looks like Discord is vulnerable to this too, oopsie

Not discord, but the default player is vulnerable to many different crash shenanigans. I get them sent to me all the time to look into and its usually just people using bogus timestamps, bogus seek times or concatenating multiple videos of different resolutions/rates that the player can't handle. If there was a way to get discord to spawn VLC for playing videos by default this would be less of a problem.

> get discord to spawn VLC

So rather than loading the bogus videos in a sandboxed Chromium instance, you want to load them in an unsandboxed VLC instance? I smell eventual RCE.

Re: Hacking YouTube with a MP4

#59
With ffmpeg, use the below command to calculate maximum timestamps

    ffmpeg -i INPUT -map 0:v -map 0:a -enc_time_base -1 -c copy -f null -
Note the time= value at the end of the process.

Re: Hacking YouTube with a MP4

#60
post #57

It's almost like we didn't learn from the days of MP3. I have several MP3s that, in certain players, are like a half hour long, despite being only 2 minutes long. My best guess was that they were assumed to be CBR, despite nothing about MP3 implying CBR… (there's not a flag or anything that says "this is a VBR" file, CBR files are just special…) Nowadays it's mostly moot since MP3 is obsolete.

> MP3 is obsolete What should we be using instead for lossy audio?

AAC is far superior, as is OGG, on a technical basis
Post reply on HN