Caution! Subtitled Files Can Hack The Devices When You Watch Movies

Entertainment Ethical Hacking Digital Electronics

Subtitled files are allowing hackers to read your information. These files are targeted for malicious software attacks that are being used to control devices like (Smart TV, Computer and Mobile Device). Check Point researchers has discovered this vulnerability.

People generally wish to see subtitles for translated movies. However, hackers are taking advantage of this and exploiting viewers in a rather shocking way.

A team Check Point has discovered this vulnerability in the four most used media player applications, where hackers are able to access viewers device via vulnerabilities via PC, Smart TV or Mobile device with the code inserted in the subtitles.

The following are the vulnerable media players which are downloaded by 200 million devices.

Stremio – TV Series, TV Channels, Videos, Movies and a Video Streaming Application.
Kodi – An Open Source Media Player Software.
Popcorn Time – Application to watch movies and TV shows instantly.
VLC Player – A very popular and mostly used VideoLan Media Player.

“We have now discovered malicious subtitles which could be created and delivered to millions of devices automatically, bypassing security software and giving the attacker full control of the infected device and the data it holds,” CheckPoint researchers said.

These vulnerabilities reside in various media players ie., the subtitled files which are used for spreading into your personal computers that can hamper hundreds of millions of the computers at the risk of getting hacked by the attacker.

What Actually Happens?

As soon the media players read the malicious sub-titles the displays the actual subtitles on the display but this also grants full control permission on the device (Smart TV, Computer and Mobile Device) on which we watched the subtitle.

How the Subtitle Malware works on the Devices

As there are so many shared repositories in the world for subtitles such as Opensubtitles, Super_subtitiles, XBMC_Subtitles, they rank and index the subtitles for the movies, as some media player download the subtitles automatically, so there is a potential possibility for attackers to inject the malicious code into the subtitles. Which allow a hacker to take total control over the subtitle supply, without any Man in the middle attack or the user interaction, this will also apply to the users who download the subtitles from the repositories.

How to Fix this Subtitle Hack

Checkpoint researchers contacted the Media player developers with the vulnerabilities which they discovered in their software’s which are mostly released in the April 2017.

For instance in VLC, the attacker can leverage on memory corruption bug.

VLC media player had four vulnerabilities (CVE-2017-8310, CVE-2017-8311, CVE-2017-8312 and CVE-2017-8313) which have been fixed by VideoLan.

A fix has been developed and it is available with VLC repository with the latest version of 2.2.5.1

A fix has been released for Kodi 17.2

To Download the fix manually you can use the below links