0

I recently downloaded subtitles for an episode of a series. I then looked at whether .srt files could contain a virus and found that that was indeed the case with some .srt files which exploited a vulnerability in a media player when loaded.

That info I found in an article from a year or 2 ago, so I wondered if this was still the case (especially for the default Android video player, I was planning to use the subs when watching the movie on my phone).

Another thing that bothered me was the fact that to check the contents of the .srt I used the website https://subtitletools.com/convert-subtitles-to-plain-text-online and downloaded a .txt of the .srt from there. I then disabled hidden extensions and opened the .txt with notepad, which sure enough revealed normal text.

Later, I saw the option to open the .srt file with Notepad++, but stupidly enough already downloaded the .txt from the website above.

That's why I am wondering whether there is a possibility of malware being present, in either the .srt or .txt (or both).

2

Both .srt and .txt subtitles and like other well known formats are pure test files - they contain text with time indexes and that's it.

It is highly unlikely that a random malware can spread by itself even if inserted in such files.

However, the only thing you should worry about are special vulnerabilities which could in theory specifically crafted so that a specific player's subtitle interpreter ends up doing something unwanted. There are over 25 subtitle formats in use, each with unique features and capabilities, which could be exploited against a specific player.

Here's an example: The StripTags function in the USF decoder and the Text decoder in VideoLAN VLC Media Player 1.1 before 1.1.6-rc allows remote attackers to execute arbitrary code via a subtitle with an opening "<" without a closing ">" in an MKV file, which triggers heap memory corruption.

Here's a take-over example video.

So, to make sure everything is fine, the 1st step is to make sure that your anti-virus solution does scan such files and does not ignore them (considering them text only and not scanning them).

Then, the next step is to patch the media players you use.

-1

.txt files cannot execute malware, however malware can be disguised to look like .txt files. Generally speaking, if you opened the file in notepad++ and just saw regular text then you should be okay.

.srt files have been used both in the past and currently to spread malware. Given the information that you have provided, if your media player and operating system are up to date then you should be fine but you have to be extremely careful downloading from any untrusted sources.

You can try uploading the file to Virustotal to see if it has any common malware or exhibits traits that are commonly found in malware. Note, however, that this is not going to 100% guarantee that there is no malware, there could be customised strains or new families of malware that are embedded which have not yet been discovered.

The best thing that you can do is to exercise caution with where you download files from and, if this is the case, to not torrent/download/stream illegal content. At least with legal sources there will be a much smaller chance of coming across malware.

  • 4
    Files do not execute malware anyway. Files contain malware that is executed. There have been vulnerable text editors that have been exploited via txt files. – schroeder Jul 23 at 17:46
  • @schroeder is there a way to check if this is the case to know whether this is the case for certain, or should I just rely on my antivirus? And is the standard notepad or notepad++ vulnerable? – DaddyMike Jul 23 at 18:30
  • 1
    @DaddyMike each program will have its vulnerabilities. Make sure you have an up-to-date version. In a text file, you will be able to see the exploit code. So unless there is something "weird" in the file, you are fine. – schroeder Jul 23 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.