this post was submitted on 28 Sep 2023
59 points (94.0% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

54758 readers
314 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others



Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):


💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 1 year ago
MODERATORS
 

I just tried opening a video I had gotten from Pahe many years ago, from an external USB drive, and have now gotten a Windows Security warning, 'Do you want to open this file?' (see top part of attached image)

I moved the file to another folder and renamed it from the original title (it was an episode of 'The Blacklist') to 'Movie.mkv and still get the warning. All files in the folder (22 of them) give this warning, plus some other videos I got from Pahe in the past. Clicking the checkbox 'always ask before opening this file' does not keep other files in the same folder from also showing the warning. I tried changing the default video player to PotPlayer, same warning comes up.

The only thing I can think of is that in the metadata of the file (bottom part of image), under 'Encoded By', it shows a URL, 'pahe (DOT) in and pahe (DOT) li'

Is there any way this could actually be a security issue? If not, is there a way to 'green light' my MKV files on my local drives?

Thanks in advance

you are viewing a single comment's thread
view the rest of the comments
[–] Onihikage@beehaw.org 3 points 1 year ago (1 children)

I suspect what you really did by removing the global tags was change the file's hash to something brand new so it was no longer on Defender's list of suspicious files. Try removing different aspects of the MKV or add a random text file as an extra subtitle and see if any of those MKVs are also flagged; they probably won't be.

[–] IverCoder@lemm.ee 2 points 1 year ago

If it's this, it's likely that the MKV file OP had just happened to hash-collide with a different known malware and caused Defender to recognize it.