this post was submitted on 28 Sep 2023
52 points (93.3% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

54609 readers
273 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others

Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 1 year ago
MODERATORS
db0@lemmy.dbzer0.com
sunbrothersco@lemmy.dbzer0.com
dataprolet@lemmy.dbzer0.com
Flatworm7591@lemmy.dbzer0.com
RandomLegend@lemmy.dbzer0.com
52
Why are my MKV videos from Pahe now flagged in Windows Defender (Win 10) with a 'Security Warning'? (lemmy.dbzer0.com)
submitted 1 year ago by GoldCross@lemmy.dbzer0.com to c/piracy@lemmy.dbzer0.com
20 comments fedilink hide all child comments
 

I just tried opening a video I had gotten from Pahe many years ago, from an external USB drive, and have now gotten a Windows Security warning, 'Do you want to open this file?' (see top part of attached image)

I moved the file to another folder and renamed it from the original title (it was an episode of 'The Blacklist') to 'Movie.mkv and still get the warning. All files in the folder (22 of them) give this warning, plus some other videos I got from Pahe in the past. Clicking the checkbox 'always ask before opening this file' does not keep other files in the same folder from also showing the warning. I tried changing the default video player to PotPlayer, same warning comes up.

The only thing I can think of is that in the metadata of the file (bottom part of image), under 'Encoded By', it shows a URL, 'pahe (DOT) in and pahe (DOT) li'

Is there any way this could actually be a security issue? If not, is there a way to 'green light' my MKV files on my local drives?

Thanks in advance

top 20 comments
sorted by: hot top controversial new old
[–] aeronmelon@lemm.ee 26 points 1 year ago (2 children)

.mkv files are just containers with a bunch of separate files inside. You can theoretically hide any kind of file inside, including an executable, so it might just be a blanket warning.

[–] sebinspace@lemmy.world 8 points 1 year ago (1 children)

Hence the name “matryoshka”

[–] AnUnusualRelic@lemmy.world 1 points 1 year ago

That's the case for a lot of media and generic data formats.

[–] GoldCross@lemmy.dbzer0.com 9 points 1 year ago

I used MKVToolNix to checkout the video file. Inside the MKV container appears to be: an H264 video file, an AAC audio file, 3x VobSubs, chaptering info, and 'global tags'. If I uncheck the 'Global Tags' entry and save the rest an a new MKV, the video opens in Windows 10 without any warning message from Windows Security.

I don't see anything in the properties data for 'global tags' that looks suspicious, or even has any entries at all (such as for timestamps, video properties, color information, color mastering meta information, etc. I don't know WHY having a 'global tags' "thing" in the MKV is causing the security warning.

Unless there's a way to have Windows 'ignore' the 'global tags' part of an MKV, I guess I will just re-multiplex the videos with that part removed.

(Sorry it took so long to reply, I didn't have my lemmy password saved to my online password manager and had to wait until I got back to my media PC to update the posts)

Thanks for the replies

[–] Overboard8171@startrek.website 9 points 1 year ago (2 children)

Has any of you considered pirated files might be marked someday for automatic deletion? Until that happens, Windows Defender tries scaring you into not using them.

[–] kryllic@programming.dev 4 points 1 year ago

I would just love to see the fallout if Microsoft did this, just arbitrarily remove content it deems to not be suitable for its users. More Linux converts for sure

[–] verdantbanana@lemmy.world 0 points 1 year ago (1 children)

we are already here

pirated hogwarts legacy will have the main exe automatically deleted by defender upon execution

[–] Overboard8171@startrek.website 1 points 1 year ago

Yah but that's not new, AV never liked the packers. The difference here is the silent deletion :(

[–] Moonrise2473@feddit.it 7 points 1 year ago (1 children)

Maybe this is the reason?

https://www.howtogeek.com/70012/what-causes-the-file-downloaded-from-the-internet-warning-and-how-can-i-easily-remove-it/

[–] Automated_Handprint@lemmy.dbzer0.com 2 points 1 year ago* (last edited 1 year ago)

This is it. I remember watching a video about this a while ago but can't find it. It has nothing to do with pahe or mkv

[–] db2@sopuli.xyz 7 points 1 year ago

Try removing or overwriting that tag, see if it fixes it.

[–] 01189998819991197253@infosec.pub 6 points 1 year ago (1 children)

Upload it to VirusTotal and let their meta engine scan it.

[–] GoldCross@lemmy.dbzer0.com 4 points 1 year ago (1 children)

Thx for the suggestion, I forgot about doing that. However, VirusTotal shows a 0 / 59 for any threats.

[–] 01189998819991197253@infosec.pub 3 points 1 year ago

If virus total says is not infected, I would say the likelihood of it being infected is very very low.

[–] HumanPerson@sh.itjust.works 2 points 1 year ago

This is something Windows is known to do. I don’t use Windows and don’t know how to disable it other than installing Linux, but it is definitely safe.

[–] taaz@biglemmowski.win 2 points 1 year ago

Scan it eith different AV, like MBAM for example and if it also detects try googling the name of the detected malware.

[–] GoldCross@lemmy.dbzer0.com 1 points 1 year ago

This is what VLC shows in media information for the file

[–] GoldCross@lemmy.dbzer0.com 1 points 1 year ago (1 children)

I thought I embedded the warning message in the first post, trying again here

[–] skullgiver@popplesburger.hilciferous.nl 6 points 1 year ago* (last edited 11 months ago)

[This comment has been deleted by an automated system]