Check Point researchers reveal a new virus attack through subtitles that may attack millions of users worldwide. The virus that is incorporated in subtitle files loaded at popular forums lets the attacker gain full control over the victim’s computer or smart television. Check Point researchers are estimating that approximately 200 million video players and streamers are running a vulnerable platform which can be hacked through subtitles. The virus can target popular video streaming platforms and media players including VLC, Kod, Popcorn Time and Strem.io.
What is the Virus?
Normally most viruses spread through ‘attack vectors’ – a term that loosely encapsulates how the virus is spread. Attack vector are categorized into two major forms: users are forced to install malicious software, or they visit a malicious website. In the case of this virus, users are downloading subtitles from mostly secure websites around the internet. These subtitle files are treated as trusted source in media players and bypass the security checks placed at the host computer.
Once the files are through, and upon the time of loading, these subtitle files can let attackers gain full control of the victim computers. The problem is compounded as the attackers are using reliable and trusted websites. The research also shows that the trusted sites can be tricked into giving higher rating to the malicious subtitles. This puts the malicious subtitles at the top leading them to get even more downloads.
Media player weakness
The attack vector is reliant on poor internal security mechanism for media players. The different and many subtitle formats in use are the major reason that such virus can exist. There are a minimum of 25 major subtitle formats in use – each one distinct and having their own use.
Platforms Update
The platforms have acknowledged the virus attack and have been working on producing fixes. Some of them can be downloaded at the following links.
- PopcornTime – Created a Fixed version; however it is not yet available to download in the official website.
The fixed version can be manually downloaded via the following link: https://ci.popcorntime.sh/job/Popcorn-Time-Desktop/249 - Kodi – Officially fixed and available to download on their website. Link: https://kodi.tv/download
- VLC– Officially fixed and available to download on their website
Link: http://get.videolan.org/vlc/2.2.5.1/win32/vlc-2.2.5.1-win32.exe - Stremio– Officially Fixed and available to download on their website
Link: https://www.strem.io/
**We at PakWired do not take responsibility for software available at external links. For better safety, keep your anti-virus program updated at all times.**
Leave a Reply
This site uses Akismet to reduce spam. Learn how your comment data is processed.
