Hacker News Reader

Comment by kwonkicker | Hacker News Reader

I don't care how broad your definition is, it shouldn't include the mp4 files in my hard drive.

How so? Everything that's interacted with by a computer can be exploited - in case of media files, here's[0] one example that gets talked about. I understand your frustration about flagging your harmless files as malicious, but it really shows just how difficult is to properly detect malware.

[0] https://security.stackexchange.com/questions/97856/can-simpl...

Er, doesn't that assume that the mp4 files on your hard drive can't genuinely be infected with viruses? Why is that assumption true?

Especially given how common media files are as an attack vector.

Are they? Compared to other forms (eg. trojans or browser/os 0days) they're not really common. I suspect you have a better chance of getting infected from a site asking you to download a "codec", than you have of the site serving you a malformed media file.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jpeg returns 390 results. And that’s jpeg alone. It’s fairly common that you see some sort of media file format parsing bug to lead to command execution.

But how many of those are actually exploited, and how does that compare to the other vectors I mentioned? Media file exploits seem in same class of exploits as spectre/rowhammer. You hear about them often (not as often as spectre/rowhammer, but I frequently see security fixes being mentioned in media player changelogs), but you rarely hear about attacks that use them.

pledge(4)ing an image or video viewer under OpenBSD doesn't look difficult at all.

Also, you can convert your PNG images to Farbleld (+.gz | +.xz) without losing quality.

And the farbleld image format it's more difficult to exploit.

I think running pledge(2) on Windows is quite difficult. :)

(At least, I'm assuming the question here is "What should Windows Defender do?" I agree that the answer to "What should OpenBSD's built-in antivirus do?" is "Literally not even exist," which it already does.)

I think most users would be happy to avoid getting infected via content files like videos and pictures[1][2].

Us power users can always just configure the exception list.

[1]: https://docs.microsoft.com/en-us/security-updates/SecurityBu...

[2]: https://www.kb.cert.org/vuls/id/297462

Reply on news.ycombinator.com