Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

Re:Malicious Subtitles Threaten Kodi, VLC and Popcorn Time U... by tomp on Wednesday May 24, 2017 @09:23AM (#14409798)

Well, M$ Office makes sense, since it's macros.

What I really don't understand is Acrobat Reader. It has a "Protected View", which is the first WTF - .pdf-s are read-only, so there should be absolutely zero active code running anyways. What's the next, much bigger WTF WTF WTF is that you need to exit protected view to print the document.

How can the program read and render the document on screen, but not print it?! How is this even possible?

[ Parent | on HN ]

Re:Malicious Subtitles Threaten Kodi, VLC and Popcorn Time U... by izacus on Wednesday May 24, 2017 @10:01AM (#14410050)

PDF can contain executable code (JavaScript to be exact), access remote URLs, and has several separate modes of display (which means that document rendered for printing is different than what you see on the screen).

PDF is an old complex format with a lot of features used in a lot of special cases that go light years beyond looking at a simple text file. It's the reason for all the issues, but keeping it useful as it is and magically waving away all issues is not really easy.

[ Parent | on HN ]

Re:Malicious Subtitles Threaten Kodi, VLC and Popcorn Time U... by leni536 on Wednesday May 24, 2017 @10:01AM (#14410046)

Javascript is part of the PDF standard (yeah...).

[ Parent | on HN ]

Re:Malicious Subtitles Threaten Kodi, VLC and Popcorn Time U... by rocqua on Wednesday May 24, 2017 @10:22AM (#14410188)

PDF is a very fancy wrapper around post-script (massive over-simplification). Post script is a Turing complete language. As such, PDF is essentially code.

[ Parent | on HN ]