TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Hacking YouTube with a MP4

273 pointsby Keyb0ardWarr10rover 3 years ago

22 comments

dylan604over 3 years ago
If you&#x27;ve played around with video formats long enough, you&#x27;ll have seen something like this. This is the basis for most speed change &quot;filters&quot;. Only the high end ones do any kind of pixel based motion estimation so that super slo-mo does not look like a slide show.<p>Also, it&#x27;s not uncommon to get odd frame rates in the containers. Even on things as &quot;innocent&quot; as listing the frame rate as 29.97 vs 30000&#x2F;1001 will affect timing (depending on usage). The variations on 23.976 is fun too: 24000&#x2F;10001. 2997&#x2F;125.<p>The muxer is an important step. When using software decoders, things can be a lot more flexible. Back when shiny round discs were popular, there were verifiers that ensured your muxed data was correct. When your decoders are in hardware, there is a very strict set of parameters the input is expected. Any deviation means the hardware cannot play the video. Early days of &quot;cheaper&quot; DVD software had issues with the muxing.
评论 #28833458 未加载
oefrhaover 3 years ago
Video timestamps are weird. Years ago I routinely pulled event VODs from an HLS source and re-uploaded to YouTube. To speed up downloading, I downloaded the MPEG-TS segments in parallel and assembled them with FFmpeg. Initially I used the basic and familiar concat demuxer during assembly. The results were fine locally. Months in a visitor told me that all my VODs had subtle yet frequent stutters. Turned out the videos played perfectly fine in any libavcodec-based (i.e. FFmpeg-based) video player, and still played fine even after libavcodec re-encoding, yet once they went through YouTube’s encoder, which AFIAK was also libavcodec-derived, subtle stutters appeared at segment boundaries. I then switched to the hls demuxer during assembly and the YouTube problem went away. I never got to the bottom of this, so to this day it’s still a mystery to me.
评论 #28837374 未加载
rozabover 3 years ago
I&#x27;ve seen many strange mp4s and webms floating around various discord communities. Some crash your client at a fitting moment in the video, some appear to be thousands of hours long, some appear to be seconds long but are actually hours long, some even loop! somehow.
评论 #28836933 未加载
评论 #28838807 未加载
评论 #28836481 未加载
retoxover 3 years ago
On some sites with a video duration limit that don&#x27;t do transcoding, at least those that allow vp8 WEBM uploads, you can change a few bytes on the input to report a false duration and upload longer videos. If you&#x27;re uploading audio only, with a static image, you can sometimes upload hours of audio before you hit the filesize limit.
koprulusectorover 3 years ago
I have no idea what or how YouTube’s backend works, but I thought it would be useful to share here that if using ffmpeg one can use the arguments -vsync drop to generate fresh time stamps based on frame rate
deathanatosover 3 years ago
It&#x27;s almost like we didn&#x27;t learn from the days of MP3. I have several MP3s that, in <i>certain</i> players, are like a half hour long, despite being only 2 minutes long. My best guess was that they were assumed to be CBR, despite nothing about MP3 implying CBR… (there&#x27;s not a flag or anything that says &quot;this is a VBR&quot; file, CBR files are just special…)<p>Nowadays it&#x27;s mostly moot since MP3 is obsolete.
评论 #28836058 未加载
评论 #28838853 未加载
评论 #28838240 未加载
smoldesuover 3 years ago
What&#x27;s the bug here? It looks like you fooled the container codec with a incorrect timecode and then when it was uploaded to YouTube, the file was rasterized into a sane format. I don&#x27;t really see an attack here, nor do I see a mitigation.
评论 #28831933 未加载
评论 #28832266 未加载
评论 #28832121 未加载
uptownover 3 years ago
Came across a video on YouTube recently that I think may be misreporting its length due to this issue:<p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=5Grsvyt5xps" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=5Grsvyt5xps</a><p>The video is 22 minutes but it&#x27;s reported at nearly 3 hours in length.
评论 #28834943 未加载
评论 #28835473 未加载
bluedinoover 3 years ago
One of my favorite &quot;breaking YouTube&quot; (jpeg, really) demos was the slow motion glitter<p><a href="https:&#x2F;&#x2F;youtu.be&#x2F;BtYKDamqo2I" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;BtYKDamqo2I</a>
评论 #28835077 未加载
1023bytesover 3 years ago
&gt;Regards, Google Security Bot
AtlasBarfedover 3 years ago
So it&#x27;s basically a compression bomb? Like those small zip files that can expand to gigantic sizes?
评论 #28833555 未加载
swyxover 3 years ago
i thought this as well explained. title a bit clickbaity, but it got me to click.<p>i&#x27;m interested in learning more about the mp4 format. where can I read more? is there a canonical read that everyone but me knows about?<p>OP seems like he has some kind of file explorer UI for it - also interested in that
评论 #28833772 未加载
评论 #28834068 未加载
chxover 3 years ago
Remember zip quines? Ah, good old days.
dapidsover 3 years ago
&quot;Hacking YouTube&quot; is a stretch description ...
评论 #28833086 未加载
评论 #28833159 未加载
leafandcoffeeover 3 years ago
Recently been playing with this. Using FFMpeg to generate videos from a series of stills, I assumed a frame rate of 1 and a fixed video length would be suitable... Turns out a lot of players are very particular about how they like their files to be set up. Windows couldn&#x27;t open the file, VLC could, Google couldn&#x27;t generate thumbnails, but could show the video. Playing them on a Pi lead to more fun and games.<p>In the end I just encoded them the &#x27;correct&#x27; way, but it was eye opening to the wildness going on in video files. I just assumed I would be able to set a duration, a frame rate, and things would &quot;work&quot;.
galad87over 3 years ago
And wait until you get to the edit lists part of the MP4 specs. Some real powerful stuff in that.
_Gyan_over 3 years ago
With ffmpeg, use the below command to calculate maximum timestamps<p><pre><code> ffmpeg -i INPUT -map 0:v -map 0:a -enc_time_base -1 -c copy -f null - </code></pre> Note the time= value at the end of the process.
Gindenover 3 years ago
I&#x27;m bit surprised about lack of financial reward- it can realistically be used to takedown processing servers in rather simple DDoS attack.
ademarreover 3 years ago
Earlier this year people were setting false video metadata to bypass TikTok&#x27;s duration limit and upload very long videos.
jaimex2over 3 years ago
Zip bombed Youtube. Nice.
phit_over 3 years ago
looks like Discord is vulnerable to this too, oopsie
评论 #28832693 未加载
评论 #28832601 未加载
warentover 3 years ago
Folks, just because the author wasn&#x27;t wearing a Guy Fawks mask with a black hoodie and made no mention of gaining access to the Central Meme Database, that doesn&#x27;t mean they weren&#x27;t hacking.<p>They were hacking around with MP4 muxers and YouTube. This is definitely the hacker spirit. The word doesn&#x27;t need to be re-appropriated by Hollywood caricatures.
评论 #28834550 未加载
评论 #28834257 未加载