4 ms·

Replacing gifs with video files does come with an increased the risk of malware being spread. If it gets common to stuff webpages full of video files we should

Replacing gifs with video files does come with an increased the risk of malware being spread. If it gets common to stuff webpages full of video files we should expect to see an increase in the use of malicious video files to do bad things. In my case, as someone who doesn't allow javascript by default and prevents media from playing automatically the only image on that entire page that loaded for me was dancingbaby.webp Everything else (if it showed up at all) displayed as generic blocked elements I'd have to click on to view (or right click to download) so if that catches on websites that are currently busy with gifs should load a lot faster and look a lot cleaner. That's a plus.

areyourllySorry 2y ago
i don't understand how one thing leads to another. if anything, a popular feature (videos) is more protected against 0days as there's more eyes on it, not the opposite. what else could a "malicious video file" be, a cognitohazard? i am aware of the facebook tails video 0day but that's not a browser issue, nor is it a common issue
- autoexec 2y ago
  > if anything, a popular feature (videos) is more protected against 0days as there's more eyes on it, not the opposite. It's usually the opposite. The more common something is, the more likely attackers are to target that thing. Adobe acrobat was a prime target for malicious PDF files because it was what everyone used. Once browsers started displaying PDF files attackers turned their attention there. Ultimately every exploit that gets discovered does result in increased security, as bad code gets patched, but there's no shortage of bad code and even long lived codebases get new flaws discovered all the time. > what else could a "malicious video file" be, a cognitohazard? malicious video files usually target whatever software processes them. Here are some other examples: https://nvd.nist.gov/vuln/detail/CVE-2023-6351 https://nvd.nist.gov/vuln/detail/CVE-2023-6351 https://nvd.nist.gov/vuln/detail/CVE-2024-13156 https://nvd.nist.gov/vuln/detail/CVE-2024-13156 https://nvd.nist.gov/vuln/detail/CVE-2023-29341 https://nvd.nist.gov/vuln/detail/CVE-2023-29341 https://nvd.nist.gov/vuln/detail/CVE-2023-6879 https://nvd.nist.gov/vuln/detail/CVE-2023-6879 https://nvd.nist.gov/vuln/detail/CVE-2024-57510 https://nvd.nist.gov/vuln/detail/CVE-2024-57510 https://nvd.nist.gov/vuln/detail/CVE-2022-2566 https://nvd.nist.gov/vuln/detail/CVE-2022-2566 https://nvd.nist.gov/vuln/detail/CVE-2020-11184 https://nvd.nist.gov/vuln/detail/CVE-2020-11184
binaryturtle 2y ago
Time to block webp by default too. It's still a way too immature format to be relied upon. In fact it already was exploitable (via libwebp), AFAIR. :^)
Lammy 2y ago
Weird to see this downvoted since this has actually happened: https://nvd.nist.gov/vuln/detail/cve-2023-4863 https://nvd.nist.gov/vuln/detail/cve-2023-4863 WebP might support GIF-like animation, but since it's just one feature of an incredibly-complicated codec it invites a huge attack surface with extremely wide range since 99% of people will use libwebp. GIF89a on the other hand is simple enough that lots of people can write a working decoder.
- autoexec 2y ago
  It's happened multiple times over a large number of formats. Even gifs have been exploited (https://www.zdnet.com/article/whatsapp-vulnerability-exploited-through-malicious-gifs-to-hijack-chat-sessions/ https://www.zdnet.com/article/whatsapp-vulnerability-exploit...), but just as you said it's the complexity of video that makes it more difficult to keep secure.

areyourllySorry 2y ago

i don't understand how one thing leads to another. if anything, a popular feature (videos) is more protected against 0days as there's more eyes on it, not the opposite. what else could a "malicious video file" be, a cognitohazard? i am aware of the facebook tails video 0day but that's not a browser issue, nor is it a common issue

autoexec 2y ago
> if anything, a popular feature (videos) is more protected against 0days as there's more eyes on it, not the opposite. It's usually the opposite. The more common something is, the more likely attackers are to target that thing. Adobe acrobat was a prime target for malicious PDF files because it was what everyone used. Once browsers started displaying PDF files attackers turned their attention there. Ultimately every exploit that gets discovered does result in increased security, as bad code gets patched, but there's no shortage of bad code and even long lived codebases get new flaws discovered all the time. > what else could a "malicious video file" be, a cognitohazard? malicious video files usually target whatever software processes them. Here are some other examples: https://nvd.nist.gov/vuln/detail/CVE-2023-6351 https://nvd.nist.gov/vuln/detail/CVE-2023-6351 https://nvd.nist.gov/vuln/detail/CVE-2024-13156 https://nvd.nist.gov/vuln/detail/CVE-2024-13156 https://nvd.nist.gov/vuln/detail/CVE-2023-29341 https://nvd.nist.gov/vuln/detail/CVE-2023-29341 https://nvd.nist.gov/vuln/detail/CVE-2023-6879 https://nvd.nist.gov/vuln/detail/CVE-2023-6879 https://nvd.nist.gov/vuln/detail/CVE-2024-57510 https://nvd.nist.gov/vuln/detail/CVE-2024-57510 https://nvd.nist.gov/vuln/detail/CVE-2022-2566 https://nvd.nist.gov/vuln/detail/CVE-2022-2566 https://nvd.nist.gov/vuln/detail/CVE-2020-11184 https://nvd.nist.gov/vuln/detail/CVE-2020-11184

binaryturtle 2y ago

Time to block webp by default too. It's still a way too immature format to be relied upon. In fact it already was exploitable (via libwebp), AFAIR. :^)

Lammy 2y ago

Weird to see this downvoted since this has actually happened: https://nvd.nist.gov/vuln/detail/cve-2023-4863 https://nvd.nist.gov/vuln/detail/cve-2023-4863 WebP might support GIF-like animation, but since it's just one feature of an incredibly-complicated codec it invites a huge attack surface with extremely wide range since 99% of people will use libwebp. GIF89a on the other hand is simple enough that lots of people can write a working decoder.

autoexec 2y ago
It's happened multiple times over a large number of formats. Even gifs have been exploited (https://www.zdnet.com/article/whatsapp-vulnerability-exploited-through-malicious-gifs-to-hijack-chat-sessions/ https://www.zdnet.com/article/whatsapp-vulnerability-exploit...), but just as you said it's the complexity of video that makes it more difficult to keep secure.