2

I kind of get it that you can get hacked by loading up an image, as there can be code embedded in the file that may execute under certain circumstances, and the image itself won’t even look much different.

Is this also true with stream media? Can you, in theory, get hacked by watching streaming services, in scenarios where

  1. A YouTube channel, which is a malicious user, uploads a crafted video with embedded code

  2. A filmmaker who publishes to Netflix, Amazon Prime Video, Hulu etc. is rogue, or unknowingly has their video files modified by a third-party malicious actor to contain embedded code

  3. Someone sends a video file to you which you open up and see that it plays like normal. File extension is .mp4/.mov or any other normal video file format.

These are some of the scenarios I can think of. I know that 3 is probably the riskiest, but please assess all three and most importantly 1 and 2 as they’re presumed to be completely safe.

Improve this question
2
  • 1
    Images don't have embedded code. Images may be crafted to trigger bugs in the image parser/viewer and such that this bug is weaponized into an exploit. So you see, this generalizes to every format that's parsed, including video. However, these vulnerabilities are very expensive, they are 1 or 0-click 0-day exploits and worth in the ballpark of the millions of dollars. They are rarely burnt on random people.
    – Margaret Bloom
    Commented Aug 8 at 15:55
  • Any program that reads a file could have an exploitable bug which can allow you to get hacked. These have been detected and fixed many times in the past, usually before anyone uses them to hack anyone.
    – user20574
    Commented Aug 8 at 18:58

1 Answer 1

Reset to default
1

In theory, you can get hacked by watching streaming services, if the player program you are using for watching it has an exploitable vulnerability (that is, a programming flaw that can be used to cause a malicious action without your knowledge and consent) and you play a stream through it that an attacker has crafted to exploit that vulnerability. This is true for all three scenarios you describe. There are various safeguards against that, such as you keeping your software up to date with the latest security fixes, or streaming providers screening their content for attempts to sneak in such crafted files, but there is no absolute security.

The situation is exactly the same as for image files. There, too, you can only be hacked if the viewing program you are using for showing the image has an exploitable vulnerability and the image file has been crafted to exploit that precise vulnerability.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .