How CIA spied on people using fake VLC video player | Lex Fridman Podcast
The transcript covers a Lex Fridman podcast discussion with a VideoLAN representative about how the CIA used a modified version of VLC media player to spy on people, as revealed by WikiLeaks' Vault 7 release. They also discuss ongoing threats from fake VLC distributors, the challenges of sandboxing VLC for security, and some quirky features of the software.
Summary
The conversation begins with the CIA Vault 7 WikiLeaks revelation, where it was discovered that the CIA had created a custom version of VLC media player with an added DLL (psapi.dll) that would read a user's document folder, encrypt the data, and send it out. The attack was cleverly disguised because users watching a movie for two hours would not notice unusual fan activity or TCP traffic, as these are normal during HD playback. VideoLAN responded by issuing a press release urging users to only download VLC from the official website.
A similar attack was carried out by Chinese hackers targeting Indian users, who extracted a legitimately signed DLL from VLC and used it in a separate malicious program. This led to VLC being temporarily banned in India, forcing VideoLAN's representative to fight the ban in Indian court. The speaker emphasized there is little VideoLAN can do to prevent such misuse of their signed components.
The discussion then shifts to an ongoing problem in Germany, where a fake VLC website has been ranking above the official one in Google search results for over 12 years. The fake installer lies dormant for three weeks before activating a service that downloads spyware and adware, including software that replaces ads on the user's machine. Google has been aware of this but has not acted, partly because the binary is too large for their virus analyzer.
The topic of VLC sandboxing is introduced as a major security initiative. Because VLC runs hundreds of plugins — including FFmpeg, GPU drivers, and third-party code — a crash could potentially be exploited to install ransomware or botnets. The challenge is that sandboxing VLC fully would require so many permissions it would defeat the purpose. The solution being developed is splitting VLC into multiple processes (decoding, demuxing, filters), each running in its own sandbox, similar to how Chrome handles tabs — but with the added complexity of sustaining hundreds of megabits per second of memory throughput.
The conversation ends on a lighter note, discussing VLC's puzzle filter — a feature that turns a video into an interactive jigsaw puzzle, originally written by a French high school math teacher to teach Bezier curves. A user later requested more complexity, prompting the speaker to increase the maximum puzzle dimensions from 16x16 to 256x256. The ASCII art/no-UI mode is also highlighted as surprisingly practical for debugging multicast networks remotely via SSH.
Key Insights
- The CIA's modified VLC added a single DLL (psapi.dll) that encrypted and exfiltrated documents from the user's folder, exploiting the fact that during movie playback, high CPU/fan usage and TCP traffic appear completely normal to the user.
- Chinese hackers targeting Indian users didn't clone VLC itself — they extracted a legitimately signed VLC DLL and used it within a separate malicious program, demonstrating that code-signing alone is insufficient protection against supply chain-style attacks.
- A fake VLC website in Germany has been outranking the official VideoLAN site on Google for over 12 years, and Google has knowingly declined to act because the malicious binary is too large for their virus analyzer to process.
- VLC's sandboxing effort is uniquely difficult compared to web browsers because it must sustain hundreds of megabits per second of memory throughput, making traditional sandboxing approaches that work for low-bandwidth web content impractical.
- VLC's puzzle filter — which turns a video into a playable jigsaw puzzle — was originally created by a French high school math teacher to teach students about Bezier curves, and was merged into VLC in 2010 after the code was deemed clean enough.
Topics
Transcript
[0:03] Okay, there's this legendary story that you pointed me to that it was discovered via WikiLeaks release of all sorts of documents the CIA was using a modified version of VLC to basically try and trick people what to steal their data? Yes, exactly. >> So can you explain what the heck happened with >> [laughter] >> So so this was a surprise, right? Because at some point WikiLeaks mentioned some documents. There were a few ones with something related to [0:34] Blu-rays and VLC, but the most interesting one was the CIA Vault 7, which if I understand correctly was the CIA had like a custom version of VLC where they had a specific plugin. Yeah, exactly. This…
Full transcript available for MurmurCast members
Sign Up to AccessMore from Lex Clips
How the Civil War ended | Gary Gallagher and Lex Fridman
Gary Gallagher and Lex Fridman discuss how the Civil War ended, focusing on Lee's surrender at Appomattox and Grant's magnanimous treatment of Confederate forces. They explore how Grant's generous surrender terms, influenced by Lincoln's reconciliation goals, contrasted with calls from Radical Republicans for harsher punishment and how this approach facilitated national reunification rather than perpetuating resentment.
White supremacy after the Civil War | Gary Gallagher and Lex Fridman
Historian Gary Gallagher discusses Reconstruction, white supremacy, and Confederate memory in post-Civil War America, emphasizing that Northern troops were insufficient to enforce equal rights for freed Black people, and explaining how the "Lost Cause" narrative allowed the South to reframe the war's purpose while Jim Crow became the mechanism for maintaining white supremacy.
The truth about the Civil War - Why people volunteered to fight | Gary Gallagher and Lex Fridman
Historian Gary Gallagher discusses the distinction between causation and motivation in Civil War volunteerism, explaining that while slavery caused the war, most Northern soldiers were motivated by belief in preserving the Union as a democratic republic. He emphasizes that understanding citizen-soldiers' sense of civic duty and American exceptionalism is essential to comprehending why ordinary people risked their lives for the Union.
Christianity and religion during the Civil War | Gary Gallagher and Lex Fridman
Both Union and Confederate sides during the American Civil War were overwhelmingly Protestant Christian and used religious justification for their military efforts. Interestingly, Confederate leaders like Lee and Jackson were notably more overtly religious in their official communications than Union commanders like Grant and Sherman.
Racism in America after slavery was abolished | Gary Gallagher and Lex Fridman
Gary Gallagher discusses how abolishing slavery was only the beginning of achieving equal rights for Black Americans, noting that most Northern whites prioritized saving the Union over ensuring racial equality. He explains that legal changes like the Civil Rights Act took over a century to achieve, while the deeper work of changing societal attitudes and prejudices remains ongoing and vulnerable to exploitation.