3

assume all downloads legal

Spent a long time trying to find an answer, this related question from 2013 (dated) doesn't fully answer my question although I do fear subtitle malware.

LBRY claims to tell you the correct file type before you download a file (let's assume that it's impossible to include a second file). I'm aware that downloading executable files could be dangerous but I've been told that video files (.mp4 etc but apparently not .wmd) are safe as they can't contain anything in them except malware.

LBRY is similar to Torrent so I've researched from that perspective. The general consensus is that if it comes from a trusted source and has lots of seeders it is GENERALLY safe. First of all that's not good enough for me, I know the internet is risky on its own but I don't want additional security risk. Second, just because a lot of people download from the host and think it's safe doesn't mean that there isn't something malicious that still hasn't been uncovered by anti-virus software (would probably require the abilities of a state-sponsored hacking team).

I'm really interested in playing with LBRY but I'm just not sure I can trust running it on my Mac. Kazaa destroyed my old computer (back in the day) so I've never experimented with P2P again. This mac runs perfectly, I want to keep it that way.

I'm running latest Mac OS.

Current theory is that it is unsafe unless I run a sandbox within a Linux VM but that sounds like a hassle to me...

closed as unclear what you're asking by Steffen Ullrich, TheJulyPlot, WhiteWinterWolf, Xiong Chiamiov, Bacon Brad Aug 1 '17 at 19:45

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You already reference questions where question and/or answers show that exploits using video and audio files exist. This shows in my opinion clearly that it is NOT always safe to run these files. And just using a Mac does not make you magically safe against such exploits. Insofar it is unclear what you try to ask with your question which is not already answered in the questions you reference. – Steffen Ullrich Aug 1 '17 at 4:27
  • @SteffenUllrich I wasn't confident in my conclusion esp given the popularity of torrenting. 1) Question linked was more unique to torrent. I'm under the impression that LBRY may actually be able to display the correct file extensions, although I'm unsure. 2) I'm unsure of subtitle malware being able to be included in those LBRY video files or if it would be a separate file added on (which lbry should separate out?) 3) Maybe windows media player/vlc etc issues already fixed? – JBallin Aug 1 '17 at 4:39
  • I believe this is an important question and I was frustrated that I couldn't find a solid answer. All I could find were Reddit/Yahoo answers and a bunch of random Torrent VPN websites. Additionally most of the focus is on legality. Posts which mention security seem to just brush it off. I've even been asking a lot about it in the LBRY slack channel and their consensus is that video files are "generally fine". It really seemed to me that people aren't educated on this and I wanted this talented community to fix that. – JBallin Aug 1 '17 at 4:44
  • 1
    To cite from the sources you've referenced: "..The media file itself (the movie or the song) could be specially crafted in a way to exploit a vulnerability in the user's media player, thus executing malicious code..", "..By crafting malicious subtitle files, which are then downloaded by a victim’s media player, attackers can take complete control over any type of device via vulnerabilities found in many popular streaming platforms..", "..There are literally thousands of examples of vulnerabilities in software that could allow video and music files to execute malicious code...", ... – Steffen Ullrich Aug 1 '17 at 4:52
  • Apart from that: while vulnerabilities get fixed new ones get discovered in old or introduced in new software. And, you ask about LBRY but also explicitly about torrents where no further checks are done about the offered files. – Steffen Ullrich Aug 1 '17 at 4:56
4

The simple fact is that you can almost never completely trust a file you downloaded from unknown sources. Even if the file is not an executable as verified by LBRY, it could contain a specific formatting exploit to affect the playback application you are using to listen or view the file. E.g. See VNC exploits on Metasploit. If the application you are using to playback the file is vulnerable, an attacker can still gain access to your system.

Making use of a sandboxed system will keep you safe but as you mentioned, it comes with additional hassle.

Not the answer you're looking for? Browse other questions tagged or ask your own question.