Media decoders are the biggest, richest, unexploited, practical and valuable target for developing end user malware and government surveillance. If I wanted to surveil a dissident using Tor for example I would deliver the payload in a protest video they download or whatever.
People open video and images files all the time. The amount of breath I see burned here on obscure or niche security concerns is ridiculous. The implementations aren’t buggy, they are just written by like one person, the sole maintainer you cannot under any circumstances discourage from doing this work, with a criticism-proof godlike level of knowledge, in vast amounts of uncommented code that makes huge numbers of unenforceable assumptions in the pursuit of better performance, targeting vast hardware with closed source binary blobs also seeking performance, on every popular platform. It’s a minefield.
It's really hard to exploit because 99.999% of video are watched online by streaming meaning that there are layers of re-encoding everywhere, so your payload is impossible to deliver there.
The only way I see to work is by using torrent where the content is exactly the same as the one you crafted locally.
Can’t agree more. Every codec implementation or video-related software package is just a giant pile of pointer-heavy C/C++ code. It’s not a bad thing because it’s fast and practically still the only way to do it. But looking at cosebases like VLC and especially ffmpeg makes me a little nervous. How many bugs like this are hidden in these libraries that we don’t know about?
Crown prince of Saudi Arabia hacked Jeff Bezos's phone by sending him a video over WhatsApp, so its definitely something that agencies are already hard at work on.
Not to defend pedophiles but they seem like the canaries of tor; there was recently one in California who remained anonymous (while using facebook no less) on tor for two years until the FBI got involved and paid for a custom exploit. Somehow they were able to use a malformed video file to leak his IP.
Maybe this is an opportunity to try another open source video player. Smplayer also works on windows mac and linux.
- Preferences menu isn't broken into normal and space shuttle control panel.
- Playlist works in fullscreen mode which isn't the case with VLC.
- Saves place in videos by default, mpv the simpler interface is actually smarter and remembers the position in a group of files if you pass it the same files. I think VLC can do this but its somewhere in the space shuttle preferences interface.
- Adding a folder doesn't add non video files to a playlist
- Audio syncing doesn't appear to be an issue over the network
- It understands any network stream that youtube-dl supports which seems to be much better than vlc
As far as I know, SMplayer is based off of mplayer which uses ffmpeg under the hood, just like VLC. The most serious vulnerabilities would be present on both (although I think this exploit is VLC specific).
[+] [-] an_opabinia|5 years ago|reply
People open video and images files all the time. The amount of breath I see burned here on obscure or niche security concerns is ridiculous. The implementations aren’t buggy, they are just written by like one person, the sole maintainer you cannot under any circumstances discourage from doing this work, with a criticism-proof godlike level of knowledge, in vast amounts of uncommented code that makes huge numbers of unenforceable assumptions in the pursuit of better performance, targeting vast hardware with closed source binary blobs also seeking performance, on every popular platform. It’s a minefield.
[+] [-] Thaxll|5 years ago|reply
The only way I see to work is by using torrent where the content is exactly the same as the one you crafted locally.
[+] [-] xd1936|5 years ago|reply
1. https://www.vice.com/en_us/article/v7gd9b/facebook-helped-fb...
[+] [-] g_airborne|5 years ago|reply
[+] [-] tlburke|5 years ago|reply
[+] [-] Denvercoder9|5 years ago|reply
[+] [-] unknown|5 years ago|reply
[deleted]
[+] [-] swiley|5 years ago|reply
Not to defend pedophiles but they seem like the canaries of tor; there was recently one in California who remained anonymous (while using facebook no less) on tor for two years until the FBI got involved and paid for a custom exploit. Somehow they were able to use a malformed video file to leak his IP.
[+] [-] chromaton|5 years ago|reply
[+] [-] andrewnicolalde|5 years ago|reply
[+] [-] jbk|5 years ago|reply
But as there are other issues on other dependencies, we preferred to bump it everywhere.
[+] [-] Aachen|5 years ago|reply
- 3.0.11 is the fixed version, the bulletin isn't about a vuln in that version.
- It only affects iOS/macOS
[+] [-] michaelmrose|5 years ago|reply
- Preferences menu isn't broken into normal and space shuttle control panel.
- Playlist works in fullscreen mode which isn't the case with VLC.
- Saves place in videos by default, mpv the simpler interface is actually smarter and remembers the position in a group of files if you pass it the same files. I think VLC can do this but its somewhere in the space shuttle preferences interface.
- Adding a folder doesn't add non video files to a playlist
- Audio syncing doesn't appear to be an issue over the network
- It understands any network stream that youtube-dl supports which seems to be much better than vlc
[+] [-] akiselev|5 years ago|reply
[+] [-] jokoon|5 years ago|reply
[+] [-] mrtweetyhack|5 years ago|reply
[deleted]
[+] [-] kulshan|5 years ago|reply
[+] [-] jbk|5 years ago|reply
[+] [-] JadeNB|5 years ago|reply