The IT Nerd

This is something that I never figured was possible. Security company Check Point has come out with a blog post that has details about a new type of exploit that leverages flaws in various media players to pwn computers. The vehicle for the pwnage is subtitles in videos:

Check Point researchers revealed a new attack vector which threatens millions of users worldwide – attack by subtitles. By crafting malicious subtitle files, which are then downloaded by a victim’s media player, attackers can take complete control over any type of device via vulnerabilities found in many popular streaming platforms, including VLC, Kodi (XBMC), Popcorn-Time and strem.io. We estimate there are approximately 200 million video players and streamers that currently run the vulnerable software, making this one of the most widespread, easily accessed and zero-resistance vulnerability reported in recent years.

There’s also a proof of concept video that you can see here:

Now the four media player apps that are mentioned have mitigations against this threat. But there are likely plenty that are not mentioned that are easily pwnable. Or at least will be pwnable now that this is out in the open and hackers start to figure out how to exploit this. Thus, I have two pieces of advice. First if you use any of the media players mentioned above, then I would say that you should update to the latest version of these players. Second, if you’re running something else, maybe you should switch to one of these four to protect yourself from the threats that are sure to come.

Having just got over the ransomware known as “WannaCry” which caused global havoc just over a couple of weeks ago, we now have something new to worry about. Meet “EternalRocks” which like “WannaCry” utilizes exploits found by and acquired from the NSA, but is far more dangerous according to this as it uses seven NSA sourced exploits to the two that “WannaCry” used. Antivirus and security company Symantec already has a write up about this new threat, which means that their products likely have countermeasures for it. Other companies are likely to follow suit as this is a clear and present danger. But at least it’s one that people see coming.

The title of this story sounds a bit harsh, but I think that this cyberattack where tens of thousands of computers in something like 170 countries are being held hostage is a wake up call for a number of groups.

The first group that needs to wake up is consumers, businesses, and governments. This attack has made it clear that we can no longer afford to ignore the topic cybersecurity. We can no longer assume that just because we have anti-virus installed that we are safe. We need to do things like back up our data which would make ransomeware attacks ineffective. We need to not be tempted to click on links or attachments that come as part of a phishing email. We need to not download anything like software, movies or music from places like BitTorrent and the like. We need to make sure that we’re always running an up to date OS (as NHS who was one of the worst hit organizations was apparently still running Windows XP) and be patching it the second that patches appear (as apparently Microsoft had a patch that was on the streets in March that would have mitigated this attack. But clearly not everyone installed it). Lastly, and I am aiming this squarely at governments and businesses, cybersecurity should no longer be an afterthought from a spending perspective. As evidenced by the events of the past few days, spending the money that you need to defend yourself adequately is not an expense, it’s money well spent.

The other group that needs a wake up call is intelligence agencies like the NSA. I say that because part of this attack came from an bug in Microsoft Windows that the NSA was presumably using as part of their “toolkit” to gather intelligence and did not report to Microsoft. However it found its way into the hands of hackers who weaponized it and here we are witnessing the greatest cyberattack to date. When government agencies like the NSA find bugs like this, they should be obliged to report this to the software or hardware vendor in question. They should not be just left out there so that someone like Wikileaks, a hacker, or a nation state stumbles upon it and decides to use it for evil, or discloses it to the world so that someone else can use it for evil. Had the NSA did the right thing when they discovered this bug, we would likely not be here talking about this attack today.

I am hoping that the events of the last few days serve as a wake up call because clearly the world has been unprepared for this sort of event. And clearly that needs to change given the scope and effects of this cyberattack as the next one will be far worse than this one, and have far more catastrophic effects unless we collectively get our act together and prepare for that cyberattack.