Chance of virus/malware and non-executable files

Question

I’ve seen this question being asked so many times, but I still have questions.

I know that to execute malicious code from non-executable files such as videos (mp4), audios (mp3) and documents (pdf), it requires an exploit in one of the software running the file.

My questions are:

1. What are the chances that a known software, up to date, such as VLC player, or even the native video player on iOS would have a vulnerability that could be exploited and execute such code?

2. What are the chances that files downloaded from legitimate sources such as Youtube, Vimeo, Archive.org, etc., on an up to date system and up to date software as mentioned in #1, would result in malware infecting your machine?

3. Does an antivirus such as BitDefender or even running the file in VirusTotal be enough to detect that injected code in non-executable files?

To put this into context, what I am looking at doing is downloading older public domain movies from archive.org to build an old classic movie (20’s to 60’s) collection. Many of the files are 2+ years old.

Answer 1

What are the chances that a known software, up to date, such as ... would have a vulnerability that could be exploited and execute such code?

This description covers a wide range of software with different qualities and it is impossible to provide some solid calculation of chance here which encompasses all this software.

In general: media codecs are usually highly optimized for performance but not for security. Some software also supports a really wide range of codecs, many of these not well tested. There were several severe vulnerabilities in the past, so the chance is definitely not zero.

What are the chances that files downloaded from legitimate sources such as Youtube, Vimeo, Archive.org, etc.,

This again describes a wide range of resources and the view what is considered "legitimate" varies. But in general: major video sites recode the videos uploaded by users for better user experience (high quality with low bandwidth) and this will usually implicitly sanitize the file so that attacks no longer work.

Does an antivirus such as BitDefender or even running the file in VirusTotal be enough to detect that injected code in non-executable files?

I would not count on these to detect the problem before the file gets executed, i.e. just from scanning. Real-time protection by antivirus will help against actually executing any malware after the vulnerability got successfully exploited, but don't expect full protection.

Answer 2

To add to the existing answer.

To put this into context, what I am looking at doing is downloading older public domain movies from archive.org to build an old classic movie (20’s to 60’s) collection. Many of the files are 2+ years old.

I've not heard of archive.org containing any malware ever, so that's a start. I won't say there's none over there but the web archive is run by the people who are not known to be malware peddlers.

Even if those file contained malware back then it's near impossible to imagine that no one has noticed it yet and the appropriate video players are still vulnerable to those files.

If you wanna be totally safe you've got several options:

• Apps like SandBoxie+ which I use to open almost anything downloaded from the web.
• Virtual Machines such as VirtualBox or VMWare Workstation/Player
• Opening files remotely via e.g. RDP/MSTSC or VNC.

All these options will prevent malware from reaching your PC/OS/data.