- Hacked in Translation When Using Popular Media Players
- According to Check Point Research Team, a hacker takes full control possibility your computer, when you use the media player with a malicious subtitle file. Many people use popular media players, including VLC, Kodi (XBMC), Popcorn Time and Stremio.
The firm estimates 200 million people are potentially at risk.
Check Point wrote about risk of a new attack vector on their website;
Our research reveals a new possible attack vector, using a completely overlooked technique in which the cyberattack is delivered when movie subtitles are loaded by the user’s media player. These subtitles repositories are, in practice, treated as a trusted source by the user or media player; our research also reveals that those repositories can be manipulated and be made to award the attacker’s malicious subtitles a high score, which results in those specific subtitles being served to the user. This method requires little or no deliberate action on the part of the user, making it all the more dangerous.
Unlike traditional attack vectors, which security firms and users are widely aware of, movie subtitles are perceived as nothing more than benign text files.
To be clear, if you’re using a media player to watch a legitimate copy of a film that already has subtitles, you’re probably just fine. But if for any reason you visited one of the numerous websites that allow you to download subtitles for movies in various languages, you could be at risk. People download these files for many reasons, not just for the purposes of piracy. There’s a thriving community of people that translate film dialogue for the good of everyone but, unfortunately, there could be some bad actors out there.
- Here are the media players that are affected and how to update them:
The fixed version can be manually downloaded here.
The fix version is currently only available as source code release. Link to the source code fix is available here.
Officially fixed and available to download on their website.
Officially Fixed and available to download on their website.
- source : Check Point