Hacker News Reader

Comment by autoexec | Hacker News Reader

Replacing gifs with video files does come with an increased the risk of malware being spread. If it gets common to stuff webpages full of video files we should expect to see an increase in the use of malicious video files to do bad things.

In my case, as someone who doesn't allow javascript by default and prevents media from playing automatically the only image on that entire page that loaded for me was dancingbaby.webp

Everything else (if it showed up at all) displayed as generic blocked elements I'd have to click on to view (or right click to download) so if that catches on websites that are currently busy with gifs should load a lot faster and look a lot cleaner. That's a plus.

View on HN

Time to block webp by default too. It's still a way too immature format to be relied upon. In fact it already was exploitable (via libwebp), AFAIR. :^)

i don't understand how one thing leads to another. if anything, a popular feature (videos) is more protected against 0days as there's more eyes on it, not the opposite. what else could a "malicious video file" be, a cognitohazard? i am aware of the facebook tails video 0day but that's not a browser issue, nor is it a common issue

> if anything, a popular feature (videos) is more protected against 0days as there's more eyes on it, not the opposite.

It's usually the opposite. The more common something is, the more likely attackers are to target that thing. Adobe acrobat was a prime target for malicious PDF files because it was what everyone used. Once browsers started displaying PDF files attackers turned their attention there.

Ultimately every exploit that gets discovered does result in increased security, as bad code gets patched, but there's no shortage of bad code and even long lived codebases get new flaws discovered all the time.

> what else could a "malicious video file" be, a cognitohazard?

malicious video files usually target whatever software processes them.

Here are some other examples:

https://nvd.nist.gov/vuln/detail/CVE-2023-6351

https://nvd.nist.gov/vuln/detail/CVE-2024-13156

https://nvd.nist.gov/vuln/detail/CVE-2023-29341

https://nvd.nist.gov/vuln/detail/CVE-2023-6879

https://nvd.nist.gov/vuln/detail/CVE-2024-57510

https://nvd.nist.gov/vuln/detail/CVE-2022-2566

https://nvd.nist.gov/vuln/detail/CVE-2020-11184

Weird to see this downvoted since this has actually happened: https://nvd.nist.gov/vuln/detail/cve-2023-4863

WebP might support GIF-like animation, but since it's just one feature of an incredibly-complicated codec it invites a huge attack surface with extremely wide range since 99% of people will use libwebp. GIF89a on the other hand is simple enough that lots of people can write a working decoder.

It's happened multiple times over a large number of formats. Even gifs have been exploited (https://www.zdnet.com/article/whatsapp-vulnerability-exploit...), but just as you said it's the complexity of video that makes it more difficult to keep secure.

Reply on news.ycombinator.com