Beware! Subtitle Files Can Hack Your Computer While You're Enjoying Movies

Do you watch movies with subtitles?

Just last night, I wanted to watch a French movie, so I searched for English subtitles and downloaded it to my computer.

Though that film was excellent, this morning a new research from Checkpoint scared me.

I was unaware that a little subtitle file could hand over full control of my computer to hackers, while I was enjoying the movie.

Yes, you heard that right.

A team of researchers at Check Point has discovered vulnerabilities in four of the most popular media player applications, which can be exploited by hackers to hijack "any type of device via vulnerabilities; whether it is a PC, a smart TV, or a mobile device" with malicious codes inserted into the subtitle files.

"We have now discovered malicious subtitles could be created and delivered to millions of devices automatically, bypassing security software and giving the attacker full control of the infected device and the data it holds," he added.

These four vulnerable media players (mentioned below) have been downloaded more than 220 million times:

• VLC — Popular VideoLAN Media Player
• Kodi (XBMC) — Open-Source Media Software
• Popcorn Time — Software to watch Movies and TV shows instantly
• Stremio — Video Streaming App for Videos, Movies, TV series and TV channels

The vulnerabilities reside in the way various media players process subtitle files and if exploited successfully, could put hundreds of millions of users at risk of getting hacked.

As soon as the media player parses those malicious subtitle files before displaying the actual subtitles on your screen, the hackers are granted full control of your computer or Smart TV on which you ran those files.

Proof-of-Concept Video

In the above video, the researchers demonstrated that how a maliciously crafted subtitle file for a movie added to Popcorn Time media player can hijack a Windows PC. On the right-hand side of the screen, an attacker, running Kali Linux, gained the remote access of the system as soon as the victim added the subtitle file.

Since text-based subtitles for movies and TV shows are created by writers and then uploaded to Internet stores, like OpenSubtitles and SubDB, hackers could also craft malicious text files for same TV shows and movies.

"Our researchers were also able to show that by manipulating the website’s ranking algorithm, we could guarantee crafted malicious subtitles would be those automatically downloaded by the media player, allowing a hacker to take complete control over the entire subtitle supply chain, without resorting to a Man in the Middle attack or requiring user interaction," CheckPoint researchers said.
The researchers believe that similar security vulnerabilities also exist in other streaming media players.

How to Protect Your Computer from Hackers?

Check Point has already informed the developers of VLC, Kodi, Popcorn Time and Stremio applications about the recently discovered vulnerabilities.

"To allow the developers more time to address the vulnerabilities, we’ve decided not to publish any further technical details at this point," the researchers said.

All of them have patched the flaws, with Stremio and VLC releasing the patched versions of their software: Stremi 4.0 and VLC 2.2.5 that has been out for two weeks.

However, Kodi developer Martijn Kaijser said the official version 17.2 release would arrive later this week, while users could get a fixed version online. A patch for Popcorn Time is also available online.

So, users are advised to update their media player as soon as possible.