Security researchers have discovered that subtitle files used in video playback can infect PCs and mobile devices with computer viruses. Experts say tens of millions of people are at risk of falling victim to the newly discovered vulnerability.
Check Point, an Israeli cybersecurity firm, has discovered that subtitle files for television shows and movies could allow hackers to achieve complete control over any type of playback device. The company has found vulnerabilities in VLC, Popcorn-time, and Kodi.
“The supply chain for subtitles is complex, with over 25 different subtitle formats in use, all with unique features and capabilities,” said Check Point vulnerability research team leader Omri Herscovici. “This fragmented ecosystem, along with limited security, means there are multiple vulnerabilities that could be exploited, making it a hugely attractive target for attackers.”
Upon identifying the security weakness, Check Point discovered malware-containing subtitles waiting to be downloaded onto millions of devices automatically, bypassing security software and giving cyber criminals complete access to infected systems and the data they hold.
Check Point says the security flaw affects about 200 million devices. According to the company’s blog, the flaw is “one of the most widespread, easily accessed vulnerabilities reported in recent years.”
Viruses are delivered to user systems when media players load infected subtitles from online repositories. Media-playing software assumes subtitles are harmless and treats them as simple text files.
“This means users, anti-virus software, and other security solutions vet them without trying to assess their real nature, leaving millions of users exposed to risk,” Check Point says. “The potential damage the attacker can inflict is endless, ranging anywhere from stealing sensitive information, installing ransomware, mass denial-of-service attacks, and much more.”
|Image Source: Flickr|