3 ms·

I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately u

by jeffbee 4mo ago

I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately unplug it and thoughtfully consider the circumstances under which it would be safe to turn it back on.

TheTon 4mo ago
Right, this is why video parse / decode ought to be sandboxed. Writing secure code for these formats, especially in C, is really hard. I just sort of glanced at the bug in the repo, but it sounds plausible. It certainly wouldn’t be the first of its kind.
- tormeh 4mo ago
  And it's my impression the code is often in assembly, which is even less structured.
Wowfunhappy 4mo ago
> I mean, that's how people get hacked. ...when was the last documented case of an in-the-wild hack targeting VNC?
- ZeWaka 4mo ago
  VLC != VNC
  - deleted 4mo ago
    [deleted]
  - Wowfunhappy 4mo ago
    Oops! I was on my phone. I meant VLC.
- commandersaki 4mo ago
  I'm guessing none to be honest. It sounds plausible but in practice it's probably too difficult to do anything useful compared to other tried and true vectors. Everyone goes to the extremes when it comes to these theories and throws out all aspects of pragmatism.
d-cc 4mo ago
>I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately unplug it and thoughtfully consider the circumstances under which it would be safe to turn it back on. What are you doing on your computer where it is really a threat to you? I'm curious as to your specific use case :)
zahlman 4mo ago
Do you feel the same way about seeing "Segmentation fault (core dumped)" in the terminal from some other arbitrary program? If not, why not?
- iamnothere 4mo ago
  Because people often use VLC to view untrusted content. Video is a great vector for distributing malware, especially sought-after grey area content like porn, conflict videos, celebrity leaks, pirated films, etc. Not enough people pay attention to the impact of video as a vector for compromise. All downloaded video should be sandboxed!
  - commandersaki 4mo ago
    How many victims are known to be exploited by video codecs? Compare that with the wider landscape of how victims are being exploited.
    - iamnothere 4mo ago
      Codec vulnerabilities in the browser have been a recurring source of exploits, as have similar vulnerabilities in phone messenger apps. The phone ones are particularly bad because phones typically preprocess received media files (for thumbnailing etc) so a vulnerability here can sometimes be chained into a remotely triggered near-instant compromise. I don’t know if there is data on exploits due to downloaded media but it would be an easy way to exploit specific target populations (find a video of interest to them and “leak” it somewhere).
      - commandersaki 3mo ago
        If said videos or media are doing that, there would be a corpus of samples by now. I'm very sceptical of this.
        iamnothere 3mo ago

by jeffbee 4mo ago

TheTon 4mo ago

Right, this is why video parse / decode ought to be sandboxed. Writing secure code for these formats, especially in C, is really hard. I just sort of glanced at the bug in the repo, but it sounds plausible. It certainly wouldn’t be the first of its kind.

tormeh 4mo ago
And it's my impression the code is often in assembly, which is even less structured.

Wowfunhappy 4mo ago

> I mean, that's how people get hacked. ...when was the last documented case of an in-the-wild hack targeting VNC?

ZeWaka 4mo ago
VLC != VNC
- deleted 4mo ago
  [deleted]
- Wowfunhappy 4mo ago
  Oops! I was on my phone. I meant VLC.
commandersaki 4mo ago
I'm guessing none to be honest. It sounds plausible but in practice it's probably too difficult to do anything useful compared to other tried and true vectors. Everyone goes to the extremes when it comes to these theories and throws out all aspects of pragmatism.

d-cc 4mo ago

>I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately unplug it and thoughtfully consider the circumstances under which it would be safe to turn it back on. What are you doing on your computer where it is really a threat to you? I'm curious as to your specific use case :)

zahlman 4mo ago

Do you feel the same way about seeing "Segmentation fault (core dumped)" in the terminal from some other arbitrary program? If not, why not?

iamnothere 4mo ago
Because people often use VLC to view untrusted content. Video is a great vector for distributing malware, especially sought-after grey area content like porn, conflict videos, celebrity leaks, pirated films, etc. Not enough people pay attention to the impact of video as a vector for compromise. All downloaded video should be sandboxed!
- commandersaki 4mo ago
  How many victims are known to be exploited by video codecs? Compare that with the wider landscape of how victims are being exploited.
  - iamnothere 4mo ago
    Codec vulnerabilities in the browser have been a recurring source of exploits, as have similar vulnerabilities in phone messenger apps. The phone ones are particularly bad because phones typically preprocess received media files (for thumbnailing etc) so a vulnerability here can sometimes be chained into a remotely triggered near-instant compromise. I don’t know if there is data on exploits due to downloaded media but it would be an easy way to exploit specific target populations (find a video of interest to them and “leak” it somewhere).
    - commandersaki 3mo ago
      If said videos or media are doing that, there would be a corpus of samples by now. I'm very sceptical of this.
      - iamnothere 3mo ago