How CIA spied on people using fake VLC video player | Lex Fridman Podcast
The transcript covers a Lex Fridman podcast discussion with a VideoLAN representative about how the CIA used a modified version of VLC media player to spy on people, as revealed by WikiLeaks' Vault 7 release. They also discuss ongoing threats from fake VLC distributors, the challenges of sandboxing VLC for security, and some quirky features of the software.
Summary
The conversation begins with the CIA Vault 7 WikiLeaks revelation, where it was discovered that the CIA had created a custom version of VLC media player with an added DLL (psapi.dll) that would read a user's document folder, encrypt the data, and send it out. The attack was cleverly disguised because users watching a movie for two hours would not notice unusual fan activity or TCP traffic, as these are normal during HD playback. VideoLAN responded by issuing a press release urging users to only download VLC from the official website.
A similar attack was carried out by Chinese hackers targeting Indian users, who extracted a legitimately signed DLL from VLC and used it in a separate malicious program. This led to VLC being temporarily banned in India, forcing VideoLAN's representative to fight the ban in Indian court. The speaker emphasized there is little VideoLAN can do to prevent such misuse of their signed components.
The discussion then shifts to an ongoing problem in Germany, where a fake VLC website has been ranking above the official one in Google search results for over 12 years. The fake installer lies dormant for three weeks before activating a service that downloads spyware and adware, including software that replaces ads on the user's machine. Google has been aware of this but has not acted, partly because the binary is too large for their virus analyzer.
The topic of VLC sandboxing is introduced as a major security initiative. Because VLC runs hundreds of plugins — including FFmpeg, GPU drivers, and third-party code — a crash could potentially be exploited to install ransomware or botnets. The challenge is that sandboxing VLC fully would require so many permissions it would defeat the purpose. The solution being developed is splitting VLC into multiple processes (decoding, demuxing, filters), each running in its own sandbox, similar to how Chrome handles tabs — but with the added complexity of sustaining hundreds of megabits per second of memory throughput.
The conversation ends on a lighter note, discussing VLC's puzzle filter — a feature that turns a video into an interactive jigsaw puzzle, originally written by a French high school math teacher to teach Bezier curves. A user later requested more complexity, prompting the speaker to increase the maximum puzzle dimensions from 16x16 to 256x256. The ASCII art/no-UI mode is also highlighted as surprisingly practical for debugging multicast networks remotely via SSH.
Key Insights
- The CIA's modified VLC added a single DLL (psapi.dll) that encrypted and exfiltrated documents from the user's folder, exploiting the fact that during movie playback, high CPU/fan usage and TCP traffic appear completely normal to the user.
- Chinese hackers targeting Indian users didn't clone VLC itself — they extracted a legitimately signed VLC DLL and used it within a separate malicious program, demonstrating that code-signing alone is insufficient protection against supply chain-style attacks.
- A fake VLC website in Germany has been outranking the official VideoLAN site on Google for over 12 years, and Google has knowingly declined to act because the malicious binary is too large for their virus analyzer to process.
- VLC's sandboxing effort is uniquely difficult compared to web browsers because it must sustain hundreds of megabits per second of memory throughput, making traditional sandboxing approaches that work for low-bandwidth web content impractical.
- VLC's puzzle filter — which turns a video into a playable jigsaw puzzle — was originally created by a French high school math teacher to teach students about Bezier curves, and was merged into VLC in 2010 after the code was deemed clean enough.
Topics
Full transcript available for MurmurCast members
Sign Up to Access