21

This question already has an answer here:

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I don't know is if they can do this to VLC on Linux (my guess is not).

When I opened the file, it did not play when I clicked the Play button and my system froze (I must reiterate I was an idiot). I did a hard restart.

I am now running a ClamAV scan (I am not confident at all in an antivirus' abilities). I ran find -cmin -20 in my home dir to look over the log of modified files (nothing suspicious found).

VLC did not have root so it could not have written to /.

Should I be worried, and why did my computer freeze?

Edit: It my have been this attack. I removed padding then sent it to Cuckoo Sandbox. VLC does not support .wmv DRM

marked as duplicate by Polynomial, Neil Smithline, Matthew, Xander, Gilles 'SO- stop being evil' May 3 '16 at 22:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Seems like someone should make and self-answer an "Is it safe to open an X file?" question and mark the rest as dupes, because 99% of the time, the answer is "Theoretically yes, but software has bugs". – Colonel Thirty Two May 2 '16 at 23:01
  • @Polynomial The difference is this is about a specific video player(VLC) and OS(Linux) – user May 3 '16 at 10:22
  • @ColonelThirtyTwo That would be good; but in general people(in this case me) know "Theoretically yes, but software has bugs", but not necessarily where to go to find the bugs or what to look for to id the bug. This is why questions like this help people like me by providing information to learn from a specific instance. – user May 3 '16 at 10:28
  • 1
    Unfortunately, many of these questions just specify a file type and not the program they use. Even if they did, I'm not sure how well received floods of "Is it safe to open X with Y" questions will be. As for where to find vulnerabilities, the Common Vulnerabilities and Exposures database is a good place to start. – Colonel Thirty Two May 3 '16 at 12:23
13

Yes, VLC can be hacked. Here you can check CVE list of VLC.

But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date.

Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will happen when that file is "fired" in sandbox.

EDIT: After being analyzed with cuckoo sandbox.

Ok, we have one problem, there is no VLC inside that sandbox, so I'd like to see what will happen in the same box with VLC, but so far there is a suspicious URL inside that file:

DO NOT OPEN LINKS!

h**p://aavid.xyz?id=&dlgx=200&dlgy=200&adv=0

After this one it will redirect you on new one:

h**p://playbackerrormediaplayercodecrequiredtoplaythisfileinstallcodec.playbackerrormediaplayercodecrequiredtoplaythisfileinstallcodec.mediaplayerfix.tech/drm.php?id=&dlgx=200&dlgy=200&adv=0

Then it will give you option to download codec:

h**p://alfafile.net/file/NfpC

and another redirection:

h**p://a5.alfafile.net/dl/8va8w/CodecFix.exe 

enter image description here

and that same file is definitely malicious.

https://www.virustotal.com/en/file/8cabc36f1e3180de4a8e429b1a6cc7e2ad04243764033916486a22c80de2244f/analysis/

For the closure; I didn't analyze that file on my own, but what I did is just a quick peek into the strings, so I can not be sure how this file is acting on the real system neither if it's using vulnerability from VLC.

  • VLC is up to date. – user May 2 '16 at 7:01
  • This files may have been supposed to be copyrighted material. Do you think they mind. I will use a vpn obviously. – user May 2 '16 at 7:15
  • 1
  • Looks like a social engineering attack. – PNDA May 2 '16 at 10:49
  • 1
    @mirsad where are you finding that url? I can only find one to Microsoft. – user May 2 '16 at 11:36
20

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code.

Like most video players vlc also has/had lots of bugs which could be exploited, including in the handling of WMV files. But it is unlikely that antivirus will find such exploits because they usually don't know much about codecs and don't even scan video files. Since such exploits are usually OS specific and most care only about Windows because of the market share you are probably safe nevertheless with Linux unless you got specifically targeted.

  • 1
    It was a widely downloaded file and had this as a read me "This video has been encoded using the latest DivX+ software, if you are having trouble playing this video please try windows media player Media Player should automatically update any out dated codecs. ". I assume that means that they are not targeting VLC or linux. – user May 2 '16 at 6:57
  • 8
    @user: If I would be an attacker I would probably also write into a file that it is best played with Windows Media Player so that the really targeted user in Linux does not suspect anything. This would just be like the mails which contain malware but which also include the information that they were scanned by whatever Antivirus and found clean. Never trust the content of untrusted files - in no way. – Steffen Ullrich May 2 '16 at 7:17
  • 1
    This answer makes me question VLC. "Like most video players vlc also has/had lots of bugs which could be exploited" – PNDA May 2 '16 at 9:49
  • 9
    @PandaLion98: VLC is no better or worse than most others. Codecs are usually developed with performance as the main target and not security. This means usually C/C++ with lots of tricks and only few checks because they just uselessly cost performance if you can assume that the data are sane. Same with processing image data. – Steffen Ullrich May 2 '16 at 10:27
  • 1
    Maybe the Windows virus exploits running on Linux caused your PC to freeze.When it froze were the cooling fans at high speed (indicates high CPU usage) – Suici Doga May 2 '16 at 12:59
5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files.

That being said, a different kind of attack is theoretically possible, if a security vulnerability were found in VLC itself which a maliciously crafted WMV could exploit. It's more-likely from your description the malicious WMV uses the former attack though.

In the case of those common malicious WMV's targeting Windows Media Player, if you inspect the WMV in a hex editor, you would find very little actual data consisting primarily of a URL, followed by nothing but empty padding to make it the expected file size.

  • The file is full size, but I think it is mostly legit with the bad placed in – user May 2 '16 at 7:26
  • 1
    @user Its possible they are now using random or even real data to pad up the file sizes now. It's been a while since I've had someone ask me about these files. (Maybe because I told them nothing good ever comes in a wmv. =) ) – Alexander O'Mara May 2 '16 at 7:31
  • I know I was really dumb – user May 2 '16 at 7:40
-6

As a programmer, the answer is simply put: "No."

Video files do not contain executable code. Even if they did, Windows is very different from Linux in design. The two use different binary formats for the OS that are incompatible. What exploits work on Windows normally won't work on Linux.

The only thing that a tampered video file could do is trip a bug in VLC or another video player, or your web browser if it is set to automatically follow links. The likelihood of such a bug allowing them to "hack" Linux using a video file is so ridiculously remote that it isn't worth mentioning.

You have a better chance of being hit by a car getting your newspaper.

I'd also consider that WMV codecs under Linux are usable but mostly an unsupported format. Microsoft rarely even uses them anymore, having set them aside in favor of MP4, which Microsoft has a patent stake in. Frankly, you shouldn't use them either -but convert it to MP4 or VP8.

If you are using something like Ubuntu or Arch Linux, you are also using programs that have not been fully debugged. You should expect issues.

Not the answer you're looking for? Browse other questions tagged or ask your own question.