How to safely watch pirated movies, open infected files?

Question

I know pirated movies .avi, .mp4 etc can contain a payload to exploit the media player been used to open the movie, or any file pdf office documents.

I use Linux but assume that's unsafe. What's a secure way to open these files and be certain they can't infect the host OS? I used to think using a live USB was a good way, I know a live USB has write access to the hard disk and could rewrite the MBR for a rootkit etc

Not sure a write protected USB or cd would help here, possibly removing the hard disk while using a live USB would solve it been able to write to the hard disk only small chance of bios been a vector then?

I know about Sandboxie for Windows and firejail for Linux I'm not sure firejail or sandboxie is a good method, also heard of using virtual machines.

I also own a Chromebook. They're meant to be security hardened so much, a drive-by on a website shouldn't infect them so I want to know if infected media files and others could be opened on ChromeOS safely. I guess I could stream from an infected site without been infected if sandboxing the os is that safe.

I know everyone has their own opinion about piracy. I only want helpful answers for the circumstances I'm asking about.

Answer 1

A couple of ideas come to mind:

1. Live CD This could be done on a device where ALL writable devices are disconnected prior to boot, and the live CD is on a device with read-only access (use CD/DVD or a write blocker). Then access the files from this "one-time" volatile OS, on an air gapped computer. This will ensure any potential malicious files are contained within a true sandbox.

2. Virtual Machine Although this method is not full proof, it provides greater protection than not using a virtual machine. For this instance, I will use VirtualBox, be self-aware, VirtualBox vulnerabilities. This shows CVE vulnerabilities that have previously been discovered and patched for VirtualBox. Setup VirtualBox and create a new VM with your OS of choice. Disable the networking interfaces for that VM within VirtualBox, insert the ISO image and proceed to access the "malicious" files. The purpose is to contain any malware and dispose of the "infected" OS after usage.

Alternative, Qubes OS is an option. "Whonix runs on top of Qubes as a VM (virtual machine), just like any other typical OS does in Qubes." similarly, Qubes OS has VMs for different sessions and uses disposable VM sessions (volatile).

Consider looking into WMV files, which were designed to allow executable code. Ergo, malware was often bundled into WMV. Executable code can be bundled into AVI, MKV, and MP4. However, they were not intended for this purpose, hence it does not conceal well.

As for the website idea. While server-side languages will not be able to do significant damage to you, client-side (JavaScript) can run executable code within your browser. This could take advantage of a vulnerability within your browser, and presume the browser uses sandboxing could jailbreak, making code execution within the OS possible. NoScript would be advisable here to disable JavaScript, also consider XSS, which has greater potential when HTTP (not secure) is used.

Answer 2

The theoretical answer is you cannot. If the attacker has a set of exploits that take over the operating system then they can write to many places beyond RAM or the hard drive. These places include but are not limited to: the UEFI (for example http://blog.frizk.net/2017/08/attacking-uefi.html), GPU (for example, https://www.extremetech.com/computing/205270-proof-of-concept-gpu-rootkit-hides-in-vram-snoops-system-activities) intel management interface (for example, https://boingboing.net/2016/06/15/intel-x86-processors-ship-with.html).

On a practical level, if you insist on trying, you have two choices: you can use a cheap device like an Amazon Fire Tablet (still rootable, and still able to attack your router and other devices from the inside), or an IoS device, which is also still attackable, but the attacks are rare, and unlikely to be wasted on you, unless you happen to work for the GRU, CIA, a human rights org that's annoyed a government, etc, etc.

Answer 3

So for me there is only one safe answer: Simply don´t. While it is intriguing to download each and every stuff on the internet, from a security point of view this is bad habit.

Pirated movies: Besides the legal concerns it´s much more convenient to join a streaming service for nowadays little money and get what you want any time even without any download hassle.

Infected files:

A) You already know that the file is infected? Why open it then? If you are looking for key generators, cracks etc then yes, most of them will have mailicous payloads inside. Its your choice of risk, but a good sandbox might help.

B) You dont know the file is infected, but you are afraid it could be? Depends on the source IMHO: From a web page with good reputation: Rather it will be ok. Check the web page if it offers hash fingerprints to compare (SHA, MD5 sums etc). From Usenet: Take care. From Hacks, Warez sites: Simply don´t.

The internet can be fun, educational and a good friend. There are so many activities you can do without getting into risk, so its easy to avoid the few activities that might harm you, your friends and family by malicious payloads spreading off your device.

Answer 4

You cannot really be sure if it’ll ever be safe to open untrusted files. The “payload” could be clever enough to bypass normal safety measures if there are any. The “safest” way I can think of when running untrustworthy files is by running them on a virtual machine, but even it’s possible to leak your host OS from a virtual machine though much more difficult.

However, i think it’s much safer to watch pirated movies streamed in websites if you use a good proxy and by making sure you do not run or download and files