3

assume all downloads legal

Spent a long time trying to find an answer, this related question from 2013 (dated) doesn't fully answer my question although I do fear subtitle malware.

LBRY claims to tell you the correct file type before you download a file (let's assume that it's impossible to include a second file). I'm aware that downloading executable files could be dangerous but I've been told that video files (.mp4 etc but apparently not .wmd) are safe as they can't contain anything in them except malware.

LBRY is similar to Torrent so I've researched from that perspective. The general consensus is that if it comes from a trusted source and has lots of seeders it is GENERALLY safe. First of all that's not good enough for me, I know the internet is risky on its own but I don't want additional security risk. Second, just because a lot of people download from the host and think it's safe doesn't mean that there isn't something malicious that still hasn't been uncovered by anti-virus software (would probably require the abilities of a state-sponsored hacking team).

I'm really interested in playing with LBRY but I'm just not sure I can trust running it on my Mac. Kazaa destroyed my old computer (back in the day) so I've never experimented with P2P again. This mac runs perfectly, I want to keep it that way.

I'm running latest Mac OS.

Current theory is that it is unsafe unless I run a sandbox within a Linux VM but that sounds like a hassle to me...

Improve this question
6
  • 1
    You already reference questions where question and/or answers show that exploits using video and audio files exist. This shows in my opinion clearly that it is NOT always safe to run these files. And just using a Mac does not make you magically safe against such exploits. Insofar it is unclear what you try to ask with your question which is not already answered in the questions you reference.
    – Steffen Ullrich
    Commented Aug 1, 2017 at 4:27
  • @SteffenUllrich I wasn't confident in my conclusion esp given the popularity of torrenting. 1) Question linked was more unique to torrent. I'm under the impression that LBRY may actually be able to display the correct file extensions, although I'm unsure. 2) I'm unsure of subtitle malware being able to be included in those LBRY video files or if it would be a separate file added on (which lbry should separate out?) 3) Maybe windows media player/vlc etc issues already fixed?
    – JBallin
    Commented Aug 1, 2017 at 4:39
  • I believe this is an important question and I was frustrated that I couldn't find a solid answer. All I could find were Reddit/Yahoo answers and a bunch of random Torrent VPN websites. Additionally most of the focus is on legality. Posts which mention security seem to just brush it off. I've even been asking a lot about it in the LBRY slack channel and their consensus is that video files are "generally fine". It really seemed to me that people aren't educated on this and I wanted this talented community to fix that.
    – JBallin
    Commented Aug 1, 2017 at 4:44
  • 1
    To cite from the sources you've referenced: "..The media file itself (the movie or the song) could be specially crafted in a way to exploit a vulnerability in the user's media player, thus executing malicious code..", "..By crafting malicious subtitle files, which are then downloaded by a victim’s media player, attackers can take complete control over any type of device via vulnerabilities found in many popular streaming platforms..", "..There are literally thousands of examples of vulnerabilities in software that could allow video and music files to execute malicious code...", ...
    – Steffen Ullrich
    Commented Aug 1, 2017 at 4:52
  • Apart from that: while vulnerabilities get fixed new ones get discovered in old or introduced in new software. And, you ask about LBRY but also explicitly about torrents where no further checks are done about the offered files.
    – Steffen Ullrich
    Commented Aug 1, 2017 at 4:56

1 Answer 1

Reset to default
4

The simple fact is that you can almost never completely trust a file you downloaded from unknown sources. Even if the file is not an executable as verified by LBRY, it could contain a specific formatting exploit to affect the playback application you are using to listen or view the file. E.g. See VNC exploits on Metasploit. If the application you are using to playback the file is vulnerable, an attacker can still gain access to your system.

Making use of a sandboxed system will keep you safe but as you mentioned, it comes with additional hassle.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .