VLC 3.0.7 and security

http://www.jbkempf.com/blog/post/2019/VLC-3.0.7-and-security

by kderbe • 7 years ago

196 69 7 years ago

kderbe• 7 years ago

I submitted this for discussion because of the "Opinion about bug bounties" section at the bottom of the post. It was interesting to read about the wide variety in quality of responses to an open source bug bounty.

philpem• 7 years ago

There's a wide variety in the quality of responses to bug reports too.

Last year I stumbled across a bug which could result in a leak of personal data (specifically, private messages). So I did the good-samaritan thing and reported it, opening with "I don't want a bug bounty for this" (it was a pretty trivial bug, just a high impact one).

What I got back was a wall-of-text missive about how it wasn't on the OWASP TOP10, wasn't eligible for a bug bounty anyway, and finished with a personal attack. I didn't even reply to it.

I haven't bothered submitting anything else, not on Hackerone, not anywhere.

michaelmrose• 7 years ago

You should have released the email complete with personal attack and all info needed to reproduce the bug after 90 days. Their incompetence isn't your problem but it is their users problem.

Aissen• 7 years ago

What's interesting here is that the VLC team (partially) implemented what Alex Ionescu called for in the conclusion of his SSTIC 2019 keynote "Pay for the fix, not for the bug":

https://www.sstic.org/2019/presentation/keynote_2019/

They did pay for the bugs, but with "large extra-bonuses for fixes". Maybe this will pave the road to a different approach.

archgoon• 7 years ago

This seems like it would incentivize simply selling to grey markets.

baby• 7 years ago

If you're an asshole there isn't much they can do.

forgotmypwd123• 7 years ago

On 8 June 2019, 08:03 by ahmet sahin simsek
hi
I downloaded thé new version and I have a problème withe subtitle please can you help me

How do these people manage to find these unrelated blog posts and decide to request tech support there?

ducttape12• 7 years ago

And why do they feel it's appropriate to ask for help there? This would be like going to a talk from a presidential candidate about fuel economy, and raising your hand and saying "My car doesn't start, can you help me?"

Scoundreller• 7 years ago

Probably a relatively new internet user with little understanding of how the whole thing works. Just uses it to watch content.

If “Facebook” is the internet to you, typing into the first comment box you find seems more reasonable than finding an FAQ.

User seems to even have their spell-check in French mode - possibly not even using their own computer to ask the question.

maccard• 7 years ago

Have you ever been to an open forum? This is exactly what it's like.

sowbug• 7 years ago

During a congressional hearing, a US Congress representative asked Sundar Pichai for tech support about his daughter's iPhone: https://www.theverge.com/2018/12/11/18136377/google-sundar-p...

aasasd• 7 years ago

Oh boy. I guess you haven't noticed but it's ubiquitous. Every communication channel for a popular program is filled with help requests and feature requests. It might've been alright back in the day when there were much fewer people on the web and apps like VLC were for enthusiasts.

A bug tracker with feature requests for a popular app is like a gang rape these days. Hundreds upon hundreds of “Why is it still not fixed, it should take just ten minutes!!!” The weirdest thing is, trackers for things like Intellij Idea or Node.js are similarly filled with every problem, wish and opinion that users have—you'd think that programmers should know better but apparently not. “Tab to exit parentheses is essential for me, I'm not migrating from Eclipse until this is implemented!”

I almost completely stopped posting issues without code when I saw the scale of this phenomenon.

altfredd• 7 years ago

Covert spam?

1) Spammer uses a bot to post harmless automated comments

2) Waits for a while, than looks which of his comments ranks higher in Google

3) Edits some of top-ranked comments to include usual viagra ads with hyperlinks to promoted websites

jstarfish• 7 years ago

This sort of thing was so much more common (and worse) in the late 90s/early 2000s.

You couldn't write a blog post about some security finding or integration achievement without it attracting a slew of comments from clueless outsourced contractors begging you to teach them how to build or deploy a related enterprise-scale solution.

sangnoir• 7 years ago

The libcurl maintainer got/gets emails[1] asking for technical support on people's cars because they likely stumbled across his email address in the mandatory license text.

1. https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/

g_sch• 7 years ago

Reminds me also of this exchange the maintainer of thttpd had with a repo guy: http://acme.com/software/thttpd/repo.html

vesinisa2• 7 years ago

The medium security issues are mostly out-of-band reads, heap overflows, NULL-dereference and use-after-free security issues. Those issues should not be exploitable with ASLR [...]

Is this really valid? I remember reading numerous Google Project Zero blog posts that begin with finding an issue that should not be exploitable thanks to ASLR, and then the research would promptly proceed to defeating ASLR - usually by chaining to some unrelated and much less serious side channel exploit.

saagarjha2• 7 years ago

Determining whether bugs are exploitable is hard: usually, the answer tends to be “yes, if you try hard enough”.

XMPPwocky• 7 years ago

And there's a whole lot of cases where bug A isn't exploitable, and bug B isn't exploitable, but bugs A and B are exploitable.

tlamponi• 7 years ago

Cannot really be said in a general way. With a lot of effort probably all of those could lead to more serious things, but not easily in a platform and setup agnostic way, i.e., you probably need time and be able to try multiple times to get you a realistic chance. If it's not possible to try multiple times (e.g., your try crashes or runs into some other protection mechanism (no-execute flag on page set, return address validation, ...) then there's, again depending on the specifics of the bug and it's context, a very slim chance to achieve a (arbitrary) remote code execution, or something similar serious, realistically.

Also, for side channels you often need to be able to run code on the host, in some way, at which point it's probably not really interesting to exploit through VLC (as it runs normally as non-root/non-admin user anyway). Else, you'd need to be able to get some VLC responses which have a code-address related measurable characteristic (normally time-deltas), not sure if VLC can be forced to leak such infos from remote.

vesinisa2• 7 years ago

Thanks for the in-depth explanation!

SCHiM• 7 years ago

VLC can also connect to a remote host and play a network stream. You could probably infer delta-T through the time it takes VLC to request the next chunk of your video/audio stream.

But still, that's a long way from exposing the address of useful gadgets or other potentially sensitive information...

jbk10• 7 years ago

(I'm the author of the blog)

Is this really valid?

Yes/No. The issue is more about categorizing between low, medium, high and critical security issues, because this impact the bounties values.

So, we have to define some guidelines on which is high or medium, because this is the most difficult part to differentiate. OOB reads gets medium, while OOB write gets high. Buffer overflows get high, while Null-deref gets medium.

If you try hard enough, those are probably exploitable, but maybe, we're not sure. While the OOB writes are exploitable, so this is more important, so it gets high.

Of course, it is important to fix everything, but we need to be fair, notably when it is not our money.

delroth• 7 years ago

If you've listened to some of my talks or spoke to me (I'm sorry for you), you know I'm a bit critic of those programs, because they give money to find the issues, not to fix them.
> What about you give money to VLC instead of random hackers?
Well, security is important, so this is cool for our users, but still this is a mixed bag, for me.

I've asked that question to Julia Reda a few months ago, and I think the answer was pretty interesting. It boils down to the absence of companies that provide this service ("security bugfix bounties") and are also willing to deal with basically being an EU contractor. So instead the EU-FOSSA bounties went to HackerOne, which is not perfect but is a step in the right direction that could be implemented immediately.

Also note that Google does provide bounties for security patches and hardening (https://www.google.com/about/appsecurity/patch-rewards/ -- VLC or ffmpeg are not in there, but many base libraries are) and for integrating FOSS projects into their fuzzing frameworks (https://www.google.com/about/appsecurity/patch-rewards/autof...). I don't know of any other company providing this kind of bounties for FOSS devs.

viach• 7 years ago

> people ranging from the usual security-asshole

This pretty much illustrates the attitude of most of the bug bounties programs holders.

vardump2• 7 years ago

Yeah, that'd really put me off reporting anything.

M2Ys4U• 7 years ago

If you read a (dead, for some reason) comment by the author, he explains what that means: https://news.ycombinator.com/item?id=20147573

dimtion• 7 years ago

VLC have a past with "security-asshole" that could explains why JB seems tired with some members of the infosec community in general. From what I've read from the past controversies, each time a security issue arises in VLC the team is attacked by an angry mob of infosecs.

This blog post closing remarks summarize the recurring issue well: https://www.beauzee.fr/2017/07/04/videolan-and-https/

vanderZwan2• 7 years ago

What this blog post doesn't mention is that they finally addressed the bug where if you have a broken file and looping enabled, it no longer gives you infinite pop-ups saying it can't play the file

saagarjha2• 7 years ago

That’s not a security bug, though?

Fnoord• 7 years ago

But it does belong as bugfix in a 3.0.x version (minor version). Both security and reliability fixes are important.

DonHopkins4• 7 years ago

I filed a bug report about something just like that many years ago (hanging in a CPU intensive loop if you remove all the files in the looping playlist out form under it, i.e. a disk drive goes offline or USB stick is unplugged), and he brushed it off and dismissed my bug report, telling me simply not to do that.

And I also took the time to file several other very detailed bug reports against the Video Effects / Magnification Zoom user interface, which is not only ugly and poorly designed from an ergonomic perspective, but actually drawn into the video at video resolution instead of being drawn in an overlay at full screen resolution, so it gets rotated and is unusable when you combine it with Video Effects / Transform / Rotate, because it fails to transform the mouse events the same as the video and user interface. He brushed that one off as working as designed, too. It's still just the same as it was many years ago when I filed that bug report.

I'm serious: Give it a try, you'll fall out of your seat laughing at how terrible it is! Check out the lowres pixelated font it uses to draw "VLC ZOOM HIDE" between the thumbnail and the bizarre curved zoom scale wedge! The mouse target area of the zoom wedge actually diminishes in size with the width of the wedge, until the minimum zoom target area is only one video pixel wide at the bottom, so it's almost impossible to click. (And it's totally impossible to click anywhere when the video is rotated or flipped, since the target area isn't correspondingly transformed.)

Yes, I know the drill: It's free software, so I should just download the source code, read it, figure out the problem, fix it myself, and post a pull request. But I don't feel spending my time doing that after the author of VLC won't even admit there's a problem.

jbk10• 7 years ago

and he brushed it off and dismissed my bug report, telling me simply not to do that.

I did not do that. That's totally not true. You are confusing me with someone else.

And the bug is fixed.

after the author of VLC won't even admit there's a problem.

There is no "the author of VLC". There are many persons, and some of them are nicer than others; but spitting on the project for that is not normal. If you have any bugreport that were closed while they should not (transform related), please mail me.

jbk10• 7 years ago

Excellent point: yes, we fixed (actually worked-around) that bug in this release.

Sorry about forgetting about it: I cared more about the FOSSA project here, and forgot about this.

vanderZwan2• 7 years ago

Oh, don't get me wrong, I'm very grateful! I just wanted to mention it to encourage others to upgrade ;)

wyldfire• 7 years ago

First off, let me just say that I use VLC and I think it's really great. I really appreciate the work done: VLC is my preferred application for watching videos on linux or android.

from the usual security-asshole to some of the nicest guys ever

It's not clear whether the asshole in question is being dogmatic about some ninety-day disclosure-to-publication deadline or whether they're maybe being rude about the project having security bugs. I have read lots of stories (mostly ones shown here on HN) about knee-jerk overreactions from CIO/CTOs from not-too-large or not-too-technical businesses w/vulnerabilities. Those kind of blame-the-messenger things likely shape their behavior with respect to disclosures.

The result of that, is that when you don't know how much to award for a security issue (is it medium or low?), you decide on the niceness of the reporter :)

Gee, this sounds like it's not considering the impact to the user. Isn't that the intent of impact ratings? I suppose the risk of misclassification here is wasting the budget of the bounty on low-harm issues or dissuading researchers from digging deeper to find the high-impact ones.

jbk10• 7 years ago

(author of the blogpost here)

It's not clear whether the asshole in question is being dogmatic about some ninety-day disclosure-to-publication deadline or whether they're maybe being rude about the project having security bugs.

Being dogmatic with 90days disclosure, would get you a "hardline security reporter", but not an "asshole".

Notably, because there has been no reporter that refused to extend by a reasonable amount of days, for us. "Hey, can we get 120 days, because we got other bugfixes and we want to do all of them together".

No, we're talking about actual assholery here:

- requesting answer and reproducibility in 24hours, and sending 10 mails in the mean time;

- sending the same issues more than 10 times, because the stacktrace he has is slightly different, but refusing to listen when told that this was the same issue, and therefore only one bounty;

- refusing to read the guidelines, and refusing to test the good version, and then insulting us;

- agressivity, or insults, to the point where the HackerOne team had to intervene several times;

- plugging the output of his fuzzer to HackerOne without checking if it actually crashes or if it is a different bug;

- submitting the same bug to a different program (Google Android Apps) to get 2 times the bounty, while the bug DID NOT apply on Android, but he did not even check;

- a few others that I forgot.

So yeah, this is not about dogmatic or hardliners: we know how to deal with those in the open source communities.

bscphil2• 7 years ago

Did you really get any of these, or were you exaggerating?

people telling us that the VLC source code was visible

If you really did and they're public anywhere (and the people weren't joking), I'd love to see them. Sounds absolutely amazing.

dontbenebby3• 7 years ago

Interestingly I had to enable JS to see the checksum for the file download (?!).

Reproducible builds + a signed list of hashes would be a nice move for security.

jbk10• 7 years ago

All videolan files are GPG-signed and have several hashes (md5+sha1+sha256)

dontbenebby3• 7 years ago

Ah, maybe I missed the link on the DL page.

All I see on the DL page are links to the source, nothing on GPG nor hashes

https://www.videolan.org/vlc/#download

When I clicked to DL my version, all I saw was a "click here to see hash" that needed me to enable JS. Just sha256, which is good btw, more is not better when it comes to hashes - sha256 is sufficient.

Many open source projects provide all these on 1 page, rather than rely on complex code to deliver the info or display it on the DL page.

Ex: https://www.torproject.org/download/ lists sigs under each OS option.

apexalpha• 7 years ago

I always wondered what purpose these hashes shown on dl pages serve. If someone can hack your website to change out the .exe or whatever, surely they could also just change the hash displayed?

rurban• 7 years ago

That the link to Julia Reda's mentioned bug bounty program, which caused all these new reportings: https://juliareda.eu/2018/12/eu-fossa-bug-bounties/

eg glibc got a payout of 45.000 which means 4 exceptional risk bugs and 1 critical. https://www.intigriti.com/public/project/glibc/glibc

I find that quite disturbing.

VLC 3.0.7 and security

Related Stories