5 ms·

VLC is pretty popular on windows, but ffmpeg? Is there any commonly used windows app that relies on it? I doubt it'd be worth one's time to write exploits for d

VLC is pretty popular on windows, but ffmpeg? Is there any commonly used windows app that relies on it? I doubt it'd be worth one's time to write exploits for desktop linux

michaelt 11mo ago
Depends if any important websites are re-compressing user-uploaded videos. If there's a website converting user-uploaded gifs to mp4 to save on bandwidth or something, I wouldn't be surprised if they used ffmpeg to do it.
dpe82 11mo ago
VLC and ffmpeg share the same underlying library family (libav*) where this vulnerability lives. > I doubt it'd be worth one's time to write exploits for desktop Linux How many developers, network administrators, etc. run desktop Linux? Gaining access to those can be very, very valuable.
- brigade 11mo ago
  FFmpeg based players have been popular for 20 years now. Has there been a single documented actual use of their libraries as the exploitation vector anytime in the last two decades?
  - dpe82 11mo ago
    I'm certain it's happened but since I don't have one off the top of my head I'll instead point out a related issue: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug) It's worth pointing out that many, many, many things use the libav* library family.
    - brigade 11mo ago
      Yes, I know that multimedia/image vulnerabilities are popular vectors for zero-click attacks. My point is that desktop players are not a vector for zero-click attacks, and ffmpeg has not generally been used in end-user situations that are targets of zero-click or drive-by attacks. Mostly because of the license, but still. If the exploit chain involves the user downloading and opening a file, something like >99% of the time the next step already involves executable code (or Office macros), which makes any ffmpeg vuln completely useless.
      - dpe82 11mo ago
        Chrome uses ffmpeg's underlying libraries. It's used way, way more than you think.
        brigade 11mo ago
        Yes, I’m quite familiar with that. Chrome is why I added the “generally” qualifier. And to the best of my knowledge, there has not been any in-the-wild exploit against Chrome through the handful of ffmpeg codecs they enable. Not even pwn2own type competitions either, as I recall.
        dpe82 11mo ago
        I guess I'm confused - are you trying to imply the lack of a thorough, publicly reported successful exploit (or us just not casually giving you one that you care about) means that we're all released from the responsibility of taking potential exploits seriously?
      - phil21 11mo ago
        In a past life as a managed hosting provider ffmpeg exploits were used to gain access to systems. It’s used for pretty much any platform you can upload video to. Some places far more competently than others.
        brigade 11mo ago
        See, I’d be interested in any actual evidence/writeups of that in the wild.
        bawolff 11mo ago
        In fairness, i dont think the majority of actual exploits used in the wild get writeups. Budget web host using outdated software getting hacked because they havent updated in 2 years isn't exactly all that interesting of a blog post even if the victim knows enough to figure out what happened.
  - dns_snek 11mo ago
    Does this count? https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/ > Given the number of opportunities present, we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by including a specially formatted but otherwise innocuous file in any app on a device that is subsequently plugged into Cellebrite and scanned. There are virtually no limits on the code that can be executed. But it was a product using a 9 year old ffmpeg build (at the time).
    - hulitu 11mo ago
      > Does this count? If Signal relies on ffmpeg to play videos instead of an externall app, i would say it is broken by design.
    - brigade 11mo ago
      I'd still consider that an academic exercise rather than an exploit that was deployed in the real world (aka against a machine the attacker did not control)
      - renewiltord 11mo ago
        Yeah, that’s just how life is. We used to run with Heartbleed and Spectre turned off.
godelski 11mo ago
> VLC is pretty popular on windows, but ffmpeg? I'm pretty confident VLC uses libavcodec > Is there any commonly used windows app that relies on it? A lot of stuff uses libavcodec
- deleted 11mo ago
  [deleted]
heavyset_go 11mo ago
ffmpeg is deployed everywhere, and old versions of ffmpeg are baked into a lot of devices. If you have a device that does image, audio or video, libav and/or ffmpeg is likely somewhere in the stack. Your TV, camera, console or streaming device might use the software. If you're using SaaS that does image, audio or video, they are likely using ffmpeg related software somewhere in their stack. Same thing with apps, Android and iOS apps might use the libraries, as well as desktop apps.
Sophira 11mo ago
Yes, lots. To name an example, yt-dip uses it on all platforms, including Windows, which means that any video downloader front-end that uses it also uses FFmpeg.
- Sophira 11mo ago
  ...I mean "yt-dlp", of course. Phone autocorrected >_<

VLC is pretty popular on windows, but ffmpeg? Is there any commonly used windows app that relies on it? I doubt it'd be worth one's time to write exploits for desktop linux

michaelt 11mo ago

Depends if any important websites are re-compressing user-uploaded videos. If there's a website converting user-uploaded gifs to mp4 to save on bandwidth or something, I wouldn't be surprised if they used ffmpeg to do it.

dpe82 11mo ago

VLC and ffmpeg share the same underlying library family (libav*) where this vulnerability lives. > I doubt it'd be worth one's time to write exploits for desktop Linux How many developers, network administrators, etc. run desktop Linux? Gaining access to those can be very, very valuable.

brigade 11mo ago
FFmpeg based players have been popular for 20 years now. Has there been a single documented actual use of their libraries as the exploitation vector anytime in the last two decades?
- dpe82 11mo ago
  I'm certain it's happened but since I don't have one off the top of my head I'll instead point out a related issue: https://en.wikipedia.org/wiki/Stagefright_(bug) https://en.wikipedia.org/wiki/Stagefright_(bug) It's worth pointing out that many, many, many things use the libav* library family.
  - brigade 11mo ago
    Yes, I know that multimedia/image vulnerabilities are popular vectors for zero-click attacks. My point is that desktop players are not a vector for zero-click attacks, and ffmpeg has not generally been used in end-user situations that are targets of zero-click or drive-by attacks. Mostly because of the license, but still. If the exploit chain involves the user downloading and opening a file, something like >99% of the time the next step already involves executable code (or Office macros), which makes any ffmpeg vuln completely useless.
    - dpe82 11mo ago
      Chrome uses ffmpeg's underlying libraries. It's used way, way more than you think.
      - brigade 11mo ago
        Yes, I’m quite familiar with that. Chrome is why I added the “generally” qualifier. And to the best of my knowledge, there has not been any in-the-wild exploit against Chrome through the handful of ffmpeg codecs they enable. Not even pwn2own type competitions either, as I recall.
        dpe82 11mo ago
        I guess I'm confused - are you trying to imply the lack of a thorough, publicly reported successful exploit (or us just not casually giving you one that you care about) means that we're all released from the responsibility of taking potential exploits seriously?
    - phil21 11mo ago
      In a past life as a managed hosting provider ffmpeg exploits were used to gain access to systems. It’s used for pretty much any platform you can upload video to. Some places far more competently than others.
      - brigade 11mo ago
        See, I’d be interested in any actual evidence/writeups of that in the wild.
        bawolff 11mo ago
        In fairness, i dont think the majority of actual exploits used in the wild get writeups. Budget web host using outdated software getting hacked because they havent updated in 2 years isn't exactly all that interesting of a blog post even if the victim knows enough to figure out what happened.
- dns_snek 11mo ago
  Does this count? https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/ > Given the number of opportunities present, we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by including a specially formatted but otherwise innocuous file in any app on a device that is subsequently plugged into Cellebrite and scanned. There are virtually no limits on the code that can be executed. But it was a product using a 9 year old ffmpeg build (at the time).
  - hulitu 11mo ago
    > Does this count? If Signal relies on ffmpeg to play videos instead of an externall app, i would say it is broken by design.
  - brigade 11mo ago
    I'd still consider that an academic exercise rather than an exploit that was deployed in the real world (aka against a machine the attacker did not control)
    - renewiltord 11mo ago
      Yeah, that’s just how life is. We used to run with Heartbleed and Spectre turned off.

godelski 11mo ago

> VLC is pretty popular on windows, but ffmpeg? I'm pretty confident VLC uses libavcodec > Is there any commonly used windows app that relies on it? A lot of stuff uses libavcodec

deleted 11mo ago
[deleted]

heavyset_go 11mo ago

ffmpeg is deployed everywhere, and old versions of ffmpeg are baked into a lot of devices. If you have a device that does image, audio or video, libav and/or ffmpeg is likely somewhere in the stack. Your TV, camera, console or streaming device might use the software. If you're using SaaS that does image, audio or video, they are likely using ffmpeg related software somewhere in their stack. Same thing with apps, Android and iOS apps might use the libraries, as well as desktop apps.

Sophira 11mo ago

Yes, lots. To name an example, yt-dip uses it on all platforms, including Windows, which means that any video downloader front-end that uses it also uses FFmpeg.

Sophira 11mo ago
...I mean "yt-dlp", of course. Phone autocorrected >_<