{"id":1179,"date":"2017-05-24T14:48:44","date_gmt":"2017-05-24T14:48:44","guid":{"rendered":"http:\/\/www.gtechbooster.com\/?p=1179"},"modified":"2023-06-21T11:44:17","modified_gmt":"2023-06-21T11:44:17","slug":"hackers-malware-in-subtitle-files","status":"publish","type":"post","link":"https:\/\/gtechbooster.com\/hackers-malware-in-subtitle-files\/","title":{"rendered":"Hackers malware in subtitle files"},"content":{"rendered":"\n

An impressive new exploit gives hackers the ability to control your desktop through malware spread by fake movie subtitles. The exploit, which essentially dumps the malware onto your desktop and then notifies the attacker, affects users of video players like Popcorn Time and VLC.<\/p>\n\n\n\n

\"\"<\/a><\/div><\/div>

Checkpoint<\/a> found that malformed subtitle files can give hackers the ability to embed code into subtitle files popular with pirated movies and TV. Because these subtitles are usually trusted by video players and users alike they were an oft-overlooked vector for hack attacks.<\/p>\n\n\n\n

Our research reveals a new possible attack vector, using a completely overlooked technique in which the cyberattack is delivered when movie subtitles are loaded by the user\u2019s media player. <\/p>\n\n\n\n

These subtitles repositories are, in practice, treated as a trusted source by the user or media player; our research also reveals that those repositories can be manipulated and be made to award the attacker\u2019s malicious subtitles a high score, which results in those specific subtitles being served to the user. <\/p>\n\n\n\n

This method requires little or no deliberate action on the part of the user, making it all the more dangerous.<\/p>\n\n\n\n

Unlike traditional attack vectors, which security firms and users are widely aware of, movie subtitles are perceived as nothing more than benign text files. <\/p>\n\n\n\n

If you\u2019re using Popcorn Time \u2013 and you know you shouldn\u2019t be \u2013 you can download a fix here. Otherwise VLC, Kodi, and Stremio should be patched automatically. <\/p>\n\n\n\n

In the demo below we see the subtitles essentially activating a TinyVNC connection with the attacker\u2019s machine, allowing full access for the desktop. It\u2019s a pretty steep price to pay just to watch Logan Noir.<\/p>\n\n\n\n

\n