Check Point researchers have discovered a new attack vector that could allow hackers to create malicious subtitles to target users of popular media platforms to gain complete control of users’ PCs, mobiles, and smart TVs.
Check Point security researchers have revealed a new attack vector threatening hundreds of millions of users of popular media players, including VLC, Kodi (XBMC), Popcorn Time and Stremio. By crafting malicious subtitles, which are then downloaded by viewers, attackers can potentially take complete control of any device running the vulnerable platforms.
“The supply chain for subtitles is complex, with over 25 different subtitle formats in use, all with unique features and capabilities,” said Omri Herscovici, vulnerability research team leader at Check Point. “This fragmented ecosystem, along with limited security, means there are multiple vulnerabilities that could be exploited, making it a hugely attractive target for attackers. We have now discovered malicious subtitles could be created and delivered to millions of devices automatically, bypassing security software and giving the attacker full control of the infected device and the data it holds.”
Check Point’s research team tested and found vulnerabilities in four of the most popular media players: VLC, Kodi, Popcorn Time and Stremio, and followed responsible disclosure guidelines to report the vulnerabilities. By exploiting vulnerabilities in these platforms, hackers were able to use the malicious files to take over the devices playing the media.
The subtitles for films or TV shows are created by a wide range of subtitle writers, and uploaded to shared online repositories, such as OpenSubtitles.org, where they are indexed and ranked. Check Point researchers also demonstrated that by manipulating the repositories’ ranking algorithm, malicious subtitles can be automatically downloaded by the media player, allowing a hacker to take complete control over the entire subtitle supply chain without user interaction.
Since the vulnerabilities were disclosed, all four companies have fixed the reported issues. Stremio and VLC have also released new software versions incorporating this fix. “To protect themselves and minimize the risk of possible attacks, users should ensure they update their streaming players to the latest versions,” concluded Herscovici.
VLC has over 170 million downloads of its latest version, released June 5, 2016. Kodi (XBMC) has reached over 10 million unique users per day, and nearly 40 million unique users per month. No current estimates exist for Popcorn Time usage, but it is estimated to be tens of millions. Check Point has reason to believe similar vulnerabilities exist in other streaming media players.
Second-hand smartphone market booms
The worldwide market for used smartphones is forecast to grow to 332.9 million units, with a market value of $67 billion, in 2023, according to IDC
International Data Corporation (IDC) expects worldwide shipments of used smartphones, inclusive of both officially refurbished and used smartphones, to reach a total of 206.7 million units in 2019. This represents an increase of 17.6% over the 175.8 million units shipped in 2018. A new IDC forecast projects used smartphone shipments will reach 332.9 million units in 2023 with a compound annual growth rate (CAGR) of 13.6% from 2018 to 2023.
This growth can be attributed to an uptick in demand for used smartphones that offer considerable savings compared with new models. Moreover, OEMs have struggled to produce new models that strike a balance between desirable new features and a price that is seen as reasonable. Looking ahead, IDC expects the deployment of 5G networks and smartphones to impact the used market as smartphone owners begin to trade in their 4G smartphones for the promise of high-performing 5G devices.
Anthony Scarsella, research manager with IDC’s Worldwide Quarterly Mobile Phone Tracker, says: “In contrast to the recent declines in the new smartphone market, as well as the forecast for minimal growth in new shipments over the next few years, the used market for smartphones shows no signs of slowing down across all parts of the globe. Refurbished and used devices continue to provide cost-effective alternatives to both consumers and businesses that are looking to save money when purchasing a smartphone. Moreover, the ability for vendors to push more affordable refurbished devices in markets in which they normally would not have a presence is helping these players grow their brand as well as their ecosystem of apps, services, and accessories.”
Worldwide Used Smartphone Shipments (shipments in millions of units)
|Rest of World||136.8||77.8%||245.7||73.8%||12.4%|
Source: IDC, Worldwide Used Smartphone Forecast, 2019–2023, Dec 2019.
Table Notes: Data is subject to change.
* Forecast projections.
Says Will Stofega, program director, Mobile Phones: “Although drivers such as regulatory compliance and environmental initiatives are still positively impacting the growth in the used market, the importance of cost-saving for new devices will continue to drive growth. Overall, we feel that the ability to use a previously owned device to fund the purchase of either a new or used device will play the most crucial role in the growth of the refurbished phone market. Trade-in combined with the increase in financing plans (EIP) will ultimately be the two main drivers of the refurbished phone market moving forward.”
According to IDC’s taxonomy, a refurbished smartphone is a device that has been used and disposed of at a collection point by its owner. Once the device has been examined and classified as suitable for refurbishment, it is sent off to a facility for reconditioning and is eventually sold via a secondary market channel. A refurbished smartphone is not a “hand me down” or gained as the result of a person-to-person sale or trade.
The IDC report, Worldwide Used Smartphone Forecast, 2019–2023 (Doc #US45726219), provides an overview and five-year forecast of the worldwide refurbished phone market and its expansion and growth by 2023. This study also provides a look at key players and the impact they will have on vendors, carriers, and consumers.
Customers and ‘super apps’ will shape travel in 2020s
Customers will take far more control of their travel experience in the 2020s, according to a 2020 Trends report released this week by Travelport, a leading technology company serving the global travel industry.
Through independent research with thousands of global travellers – including 500 in South Africa – hundreds of travel professionals and interviews with leaders of some of the world’s biggest travel brands, Travelport uncovered the major forces that will become the technology enablers of travel over the next decade. These include:
Customers in control
Several trends highlight the finding that customers are moving towards self-service options, with 61% of the travellers surveyed in South Africa preferring to hear about travel disruption via digital communications, such as push notifications on an app, mobile chatbots, or instant messaging apps, rather than speaking with a person on the phone. This is especially important when it comes to young travellers under 25, seen as the future business traveler, and managing their high expectations through technology.
With the threat of super app domination, online travel agencies must disrupt or risk being disrupted. Contextual messaging across the journey will help. Super app tech giants like WeChat give their users a one-stop shop to communicate, shop online, book travel, bank, find a date, get food delivery, and pay for anything within a single, unified smartphone app. Travel brands that want to deliver holistic mobile customer experiences need to think about how they engage travellers within these super apps as well as in their own mobile channels.
In the next year, research shows, we will see an accelerated rate of change in the way travel is retailed and purchased online. This includes wider and more complex multi-content reach, more enriched and comparable offerings, more focus on relevance than magnitude, and an increase in automation that enables customer self-service.
“How customers engage with their travel experience – for instance by interacting with digital ‘bots’ and expecting offers better personalised to their needs – is changing rapidly,” says Adrian Roodt, country manager for Southern Africa at Travelport. “We in the travel industry need to understand and keep pace with these forces to make sure we’re continuing to make the experience of buying and managing travel continually better, for everyone.”
Read the full 2020 Trends report here: 2020 Trends hub.