Submitted via IRC for TheMightyBuzzard
Check Point researchers revealed a new attack vector threatening millions of users of popular media players, including VLC, Kodi (XBMC), Popcorn Time and Stremio. By crafting malicious subtitle files for films and TV programmes, which are then downloaded by viewers, attackers can potentially take complete control of any device running the vulnerable platforms.
"The supply chain for subtitles is complex, with over 25 different subtitle formats in use, all with unique features and capabilities. This fragmented ecosystem, along with limited security, means there are multiple vulnerabilities that could be exploited, making it a hugely attractive target for attackers," said Omri Herscovici, vulnerability research team leader at Check Point.
The subtitles for films or TV shows are created by a wide range of subtitle writers, and uploaded to shared online repositories, such as OpenSubtitles.org, where they are indexed and ranked. Researchers also demonstrated that by manipulating the repositories' ranking algorithm, malicious subtitles can be automatically downloaded by the media player, allowing a hacker to take complete control over the entire subtitle supply chain without user interaction.
Source: https://www.helpnetsecurity.com/2017/05/23/subtitle-hack/
(Score: 2) by GreatAuntAnesthesia on Tuesday May 23 2017, @11:09PM (2 children)
Logically, the third option is to keep humans and the internet, but ditch computers. Of course you'll have to learn how to code/decode TCP/IP by listening to a 300 baud modem and whistling in response...
(Score: 2) by art guerrilla on Wednesday May 24 2017, @12:31AM
given that there are some blind people who have managed to vocalize clicks and use the echo-location response to navigate the world around them; yeah, i bet there are some one-in-a-million who *can* listen/decode, encode/whistle...
.
those fuggin human beans, their wetware is amazing...
(Score: 1) by butthurt on Wednesday May 24 2017, @02:15AM
https://tools.ietf.org/html/rfc1149 [ietf.org]