[tcsh]

Do you watch movies with subtitles?
Just last night, I wanted to watch a French movie, so I searched for English subtitles and downloaded it to my computer.
Though that film was excellent, this morning a new research from Checkpoint scared me.
I was unaware that a little subtitle file could hand over full control of my computer to hackers, while I was enjoying the movie.
Yes, you heard that right.
A team of researchers at Check Point has discovered vulnerabilities in four of the most popular media player applications, which can be exploited by hackers to hijack "any type of device via vulnerabilities; whether it is a PC, a smart TV, or a mobile device" with malicious codes inserted into the subtitle files.

Full article

How to Protect Your Computer?

Code

Check Point has already informed the developers of VLC, Kodi, Popcorn Time and Stremio applications about the recently discovered vulnerabilities.
"To allow the developers more time to address the vulnerabilities, we’ve decided not to publish any further technical details at this point," the researchers said.
All of them have patched the flaws, with Stremio and VLC releasing the patched versions of their software: Stremi 4.0 and VLC 2.2.5 that has been out for two weeks.
However, Kodi developer Martijn Kaijser said the official version 17.2 release would arrive later this week, while users could get a fixed version online. A patch for Popcorn Time is also available online.
So, users are advised to update their media player as soon as possible.

[Cannot Compute]

That's why you don't download random shit off the internet.

[tcsh]

That's why you don't download random shit off the internet.

What does that have to do with it? It's a subtitle file, I'm sure everyone has had a problem with one of them once and used the internet. lol, your name suits you. 😏

[Magicmann]

What does that have to do with it? It's a subtitle file, I'm sure everyone has had a problem with one of them once and used the internet. lol, your name suits you. 😏

As someone that has worked in the computer industry, most infections are your own fault because you went to a sketchy site or fell for something.

[Regulus]

I've been using a lots of Swedish subtitles from YIFY.
I hope I am not affected.

[๖ۣۜÑåzgйŀ]

As someone that has worked in the computer industry, most infections are your own fault because you went to a sketchy site or fell for something.

what he probably meant to say was that since it was not a executable file it looked harmless
but the truth is malware can be hidden in anything (in a media file such as mp3 to a document file such as .doc or .pdf)
I honestly would have never expected a subtitle file to be anywhere near sketchy

to prevent this issue you need to run vlc with very low privileges and sandboxed

[.BangsOnly]

what he probably meant to say was that since it was not a executable file it looked harmless
but the truth is malware can be hidden in anything (in a media file such as mp3 to a document file such as .doc or .pdf)
I honestly would have never expected a subtitle file to be anywhere near sketchy

to prevent this issue you need to run vlc with very low privileges and sandboxed

I agree. I wouldn't expect a subtitle file to be dirty but most of the time a antivirus woulda slapped me. Also most people wouldn't run vlc sandboxed. I woulda definitly gotten hit with that.

It's good to know.

[ℂORፕΞX]

what he probably meant to say was that since it was not a executable file it looked harmless
but the truth is malware can be hidden in anything (in a media file such as mp3 to a document file such as .doc or .pdf)
I honestly would have never expected a subtitle file to be anywhere near sketchy

to prevent this issue you need to run vlc with very low privileges and sandboxed

Would like to see an exe to mp3 converter._.
Would have to be some crazy 0day shit.

[tcsh]

As someone that has worked in the computer industry, most infections are your own fault because you went to a sketchy site or fell for something.

Uhm, it's a subtitle file, how does downloading a subtitle file mean you "download random shit" like the dude I was referring said? :P

Anyway, just an awareness thread, be sure to update and stay safe.

[ɡringo]

Very interesting, I was not aware this was a thing thanks for the heads up. I usually stream movies to my fire stick through kodi but if it's some obscure shit that I need subtitles for I'll be sure to remember this.

[Reece Morgan]

what he probably meant to say was that since it was not a executable file it looked harmless
but the truth is malware can be hidden in anything (in a media file such as mp3 to a document file such as .doc or .pdf)
I honestly would have never expected a subtitle file to be anywhere near sketchy

to prevent this issue you need to run vlc with very low privileges and sandboxed

It's important to note here that just because a file isn't an executable file, the code in it can still be executed. Just because something isn't .exe doesn't mean that there isn't code inside capable of being executed on your computer.

Any type of file can be used to hide malware, it's just that files are executed in different ways depending on their extension.

[Silver Fang]

It's important to note here that just because a file isn't an executable file, the code in it can still be executed. Just because something isn't .exe doesn't mean that there isn't code inside capable of being executed on your computer.

Any type of file can be used to hide malware, it's just that files are executed in different ways depending on their extension.

In this case, via a videoplayer that already have all the needed rights (?)
How does it evolve to a working executable without the player though, or is it allowed to be kept as a allowed application without the player?edit: (probably dumb question as it already had all the rights)
Nevermind.

[Reece Morgan]

In this case, via a videoplayer that already have all the needed rights (?)
How does it evolve to a working executable without the player though, or is it allowed to be kept as a allowed application without the player?edit: (probably dumb question as it already had all the rights)
Nevermind.

Yes it would have been executed by the videoplayer.

[Minisaints]

People who can't read should be okay then.

[tcsh]

People who can't read should be okay then.

😏😏 You're creative, I'll give you that!