Idea - Run code using a youtube video

[Faisal A]

Wouldn't it be possible to run code using a youtube video by putting the pixels in such a format that when the computer executes it, it executes code instead ? And if it is possible, what could be done to avoid that type of attack. Not planning to do anything just wondering.

[emosun]

yeah , easy

this was done in the 1990s on vhs tapes that stored digital data in the form of static , you could play the tape in a vcr and the pc could read each static pixel and decode the information.

As for an attack via youtube , no you would need a program on the user side to read the static

[Levent]

5 minutes ago, Faisal A said:

Wouldn't it be possible to run code using a youtube video by putting the pixels in such a format that when the computer executes it, it executes code instead ? And if it is possible, what could be done to avoid that type of attack. Not planning to do anything just wondering.

it cant be done with "pixels" and youtube converts videos in to their format so you wont be hacking people off youtube, malicious payload was possible to hide in to some media formats, (IIRC there was one instance where malware was injected in to IDV3 tag of mp3 files but that didnt fuck up playback)

[WereCatf]

6 minutes ago, Faisal A said:

by putting the pixels in such a format that when the computer executes it

You don't execute a video when you watch it. It doesn't work like that.

[minibois]

Kind of sounds like how some programs used to be produced on a cassette tape:

 

[vanished]

I'm not sure I understand.  If you mean store code in video formats then yes, as mentioned this is similar to tape tech from decades ago.  But video decoders are not in the habit of interpreting their output signal as instructions and running them so you can't run code stored this way by just watching the video.

 

Considerations for storing code would be that it has to survive the compression process, so you will not get perfect RGB data on a pixel by pixel level.

[emosun]

1 minute ago, WereCatf said:

You don't execute a video when you watch it. It doesn't work like that.

you'd have to essentially have a program on the victims end that would read the screen information and a regular player wont do that

 

1 minute ago, Minibois said:

Kind of sounds like how some programs used to be produced on a cassette tape:

exactly that , thats how vhs did it in the old days

the concept is possible today easily , but again both ends would need compatible softwares

[GrockleTD]

2 minutes ago, WereCatf said:

You don't execute a video when you watch it. It doesn't work like that.

But then who kills it to replace it with the next one?

[HanZie82]

15 minutes ago, Faisal A said:

Wouldn't it be possible to run code using a youtube video by putting the pixels in such a format that when the computer executes it, it executes code instead ? And if it is possible, what could be done to avoid that type of attack. Not planning to do anything just wondering.

Can easily be done, but there is nothing already in place to 'read' them pixels so doign something to prevent it is unessasery.

 

It's what they used on TV signals to put the closed captions as a selectable thing. But even those wont execute code, it would just display it on screen.

[Sauron]

No, you can't get a computer to run a program just by uploading it to youtube pretending that it's a video.

[dalekphalm]

YouTube transcodes their video, so if the "code" was individual pixels?

 

Well, no more code. Because after transcoding, there will be minute pixel by pixel differences.

 

However, if you had an unaltered video, where the "code" was baked in during the encoding process, sure - you're halfway there.

 

But as others have said, the computer won't do anything with the code.

 

That'd be the equivalent of me looking at code for malware in a text file. Seeing the code is meaningless - I need something to execute the code. And no video player on the market would execute code based on pixels. You'd have to have already included malicious code in a Video Player (such as YouTube's web client, or VLC, or something), in order to achieve whatever it was you wanted to do. And at that point, you've already compromised a program, just have it do whatever you wanted.

 

TL;DR, no. This won't work for numerous reasons.

[PlayStation 2]

3 minutes ago, dalekphalm said:

YouTube transcodes their video, so if the "code" was individual pixels?

 

Well, no more code. Because after transcoding, there will be minute pixel by pixel differences.

I dunno about this specifically; so long as there was a healthy amount of error-correction built into how OP would want to read code from a video, it could be plausible but not really practical to read code from a YouTube video.

The main problem here is that OP also wants to do individual pixels rather than trying to work around how a video codec would compress a video. In a case like that, YouTube (and frankly, any realistic video encoder) is gonna want to compress the hell out of that. If the video was, say, a 1920x1080 video at 60fps, OP could potentially try shoving what he needs to shove in a video using something like 8x8 blocks, but even still, I don't think that'd work the way OP would want it to.

[dalekphalm]

9 minutes ago, Dan Castellaneta said:

I dunno about this specifically; so long as there was a healthy amount of error-correction built into how OP would want to read code from a video, it could be plausible but not really practical to read code from a YouTube video.

Sure you could do that, but then it's no longer individual pixels, because you'd have to use larger blocks of pixels to ensure that none of your code was changed inadvertently.

 

That part could definitely be done, but the 2nd half of the equation makes it all pointless.

9 minutes ago, Dan Castellaneta said:

The main problem here is that OP also wants to do individual pixels rather than trying to work around how a video codec would compress a video. In a case like that, YouTube (and frankly, any realistic video encoder) is gonna want to compress the hell out of that. If the video was, say, a 1920x1080 video at 60fps, OP could potentially try shoving what he needs to shove in a video using something like 8x8 blocks, but even still, I don't think that'd work the way OP would want it to.

Agreed.

[shaz2sxy]

I used to use VBS on my old Amiga to backup the hard drive onto VHS

 

http://www.generationamiga.com/2017/09/03/video-backup-system-connect-a-vcr-to-your-commodore-amiga-computer-to-backup-data/

 

 

So without anythign to decode it it would be useless

[Mira Yurizaki]

1 hour ago, Faisal A said:

Wouldn't it be possible to run code using a youtube video by putting the pixels in such a format that when the computer executes it, it executes code instead ? And if it is possible, what could be done to avoid that type of attack. Not planning to do anything just wondering.

Yes, it's possible, but it requires:

• Something to scan the video feed, either directly from frame buffer data off the video card or from a camera
• Something that understands what its reading is code that can be executed, not data.

Basically you're suggesting flashing QR codes in succession. Only this QR code contains code and data instead of just data.

 

The only problem is data density and the fact YouTube compresses video. So you need to have the video show something with a large enough tolerance such that compression doesn't mangle it. This likely limits you to a low bit color schema if not black and white only.

 

EDIT: You can limit using this for nefarious purposes by treating the pixels in the video as data only. This is why QR code attacks haven't really been a thing. All (at least trusted) QR code readers treat what they read as data only.

 

Although certain types of data may cause denial-of-service type attacks, like the Billion Laughs attack for XML files. It's still data, but it's data designed in such a way that a reader will blow up trying to look at it.

[wasab]

7 hours ago, Faisal A said:

Wouldn't it be possible to run code using a youtube video by putting the pixels in such a format that when the computer executes it, it executes code instead ? And if it is possible, what could be done to avoid that type of attack. Not planning to do anything just wondering.

That is a fabulous idea actually. 

[Video Beagle]

Could be used for Steganography..embeding messages to pass along...Linus could have messages in the backgrounds of videos that his sleeper agents around the globe use special programs that translate the messages so they know when to begin the sandalista revolution.....

 

but there's easier ways of doing that.