Researchers discover dangerous media player subtitle hack, fixes are on the way

If you are often watching content on applications like Kodi, Popcorn Time and VLC with subtitles on, then you may want to be extra careful at the moment as a new vulnerability has been discovered. It turns out that older versions of these bits of software are all open to an easily accessed vulnerability, which uses subtitle files to execute malicious code.

Most subtitle makers do so with non-malicious intentions. However, according to the researchers at security firm Check Point, if you were unfortunate enough to come across a malicious subtitle file, a hacker could potentially access your entire system. Below you can see a demonstration of how the attack would work:

Here is how Checkpoint explains it: “Our research reveals a new possible attack vector, using a completely overlooked technique in which the cyberattack is delivered when movie subtitles are loaded by the user’s media player. These subtitles repositories are, in practice, treated as a trusted source by the user or media player; our research also reveals that those repositories can be manipulated and be made to award the attacker’s malicious subtitles a high score, which results in those specific subtitles being served to the user. This method requires little or no deliberate action on the part of the user, making it all the more dangerous.”

Given the amount of Kodi and VLC users out there, the scope of this vulnerability is pretty massive. Fortunately, updates across the board have already been issued, so if you aren't somewhere that updates your media player often, then make sure you do so now that this fix is out.

You can go to Check Point's full report to see more details on the affected platforms and links to fixes.

KitGuru Says: Remember to update your software guys, these swift fixes are no good if people don't download them. 

Become a Patron!