Hacking YouTube with a MP4

If you&#x27;ve played around with video formats long enough, you&#x27;ll have seen something like this. This is the basis for most speed change &quot;filters&quot;. Only the high end ones do any kind of pixel based motion estimation so that super slo-mo does not look like a slide show.<p>Also, it&#x27;s not uncommon to get odd frame rates in the containers. Even on things as &quot;innocent&quot; as listing the frame rate as 29.97 vs 30000&#x2F;1001 will affect timing (depending on usage). The variations on 23.976 is fun too: 24000&#x2F;10001. 2997&#x2F;125.<p>The muxer is an important step. When using software decoders, things can be a lot more flexible. Back when shiny round discs were popular, there were verifiers that ensured your muxed data was correct. When your decoders are in hardware, there is a very strict set of parameters the input is expected. Any deviation means the hardware cannot play the video. Early days of &quot;cheaper&quot; DVD software had issues with the muxing.

Video timestamps are weird. Years ago I routinely pulled event VODs from an HLS source and re-uploaded to YouTube. To speed up downloading, I downloaded the MPEG-TS segments in parallel and assembled them with FFmpeg. Initially I used the basic and familiar concat demuxer during assembly. The results were fine locally. Months in a visitor told me that all my VODs had subtle yet frequent stutters. Turned out the videos played perfectly fine in any libavcodec-based (i.e. FFmpeg-based) video player, and still played fine even after libavcodec re-encoding, yet once they went through YouTube’s encoder, which AFIAK was also libavcodec-derived, subtle stutters appeared at segment boundaries. I then switched to the hls demuxer during assembly and the YouTube problem went away. I never got to the bottom of this, so to this day it’s still a mystery to me.

I&#x27;ve seen many strange mp4s and webms floating around various discord communities. Some crash your client at a fitting moment in the video, some appear to be thousands of hours long, some appear to be seconds long but are actually hours long, some even loop! somehow.

On some sites with a video duration limit that don&#x27;t do transcoding, at least those that allow vp8 WEBM uploads, you can change a few bytes on the input to report a false duration and upload longer videos. If you&#x27;re uploading audio only, with a static image, you can sometimes upload hours of audio before you hit the filesize limit.

I have no idea what or how YouTube’s backend works, but I thought it would be useful to share here that if using ffmpeg one can use the arguments -vsync drop to generate fresh time stamps based on frame rate

It&#x27;s almost like we didn&#x27;t learn from the days of MP3. I have several MP3s that, in <i>certain</i> players, are like a half hour long, despite being only 2 minutes long. My best guess was that they were assumed to be CBR, despite nothing about MP3 implying CBR… (there&#x27;s not a flag or anything that says &quot;this is a VBR&quot; file, CBR files are just special…)<p>Nowadays it&#x27;s mostly moot since MP3 is obsolete.

What&#x27;s the bug here? It looks like you fooled the container codec with a incorrect timecode and then when it was uploaded to YouTube, the file was rasterized into a sane format. I don&#x27;t really see an attack here, nor do I see a mitigation.

Came across a video on YouTube recently that I think may be misreporting its length due to this issue:<p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=5Grsvyt5xps" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=5Grsvyt5xps</a><p>The video is 22 minutes but it&#x27;s reported at nearly 3 hours in length.

One of my favorite &quot;breaking YouTube&quot; (jpeg, really) demos was the slow motion glitter<p><a href="https:&#x2F;&#x2F;youtu.be&#x2F;BtYKDamqo2I" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;BtYKDamqo2I</a>

&gt;Regards, Google Security Bot

So it&#x27;s basically a compression bomb? Like those small zip files that can expand to gigantic sizes?

i thought this as well explained. title a bit clickbaity, but it got me to click.<p>i&#x27;m interested in learning more about the mp4 format. where can I read more? is there a canonical read that everyone but me knows about?<p>OP seems like he has some kind of file explorer UI for it - also interested in that

Remember zip quines? Ah, good old days.

&quot;Hacking YouTube&quot; is a stretch description ...

Recently been playing with this. Using FFMpeg to generate videos from a series of stills, I assumed a frame rate of 1 and a fixed video length would be suitable... Turns out a lot of players are very particular about how they like their files to be set up. Windows couldn&#x27;t open the file, VLC could, Google couldn&#x27;t generate thumbnails, but could show the video. Playing them on a Pi lead to more fun and games.<p>In the end I just encoded them the &#x27;correct&#x27; way, but it was eye opening to the wildness going on in video files. I just assumed I would be able to set a duration, a frame rate, and things would &quot;work&quot;.

And wait until you get to the edit lists part of the MP4 specs. Some real powerful stuff in that.

With ffmpeg, use the below command to calculate maximum timestamps<p><pre><code> ffmpeg -i INPUT -map 0:v -map 0:a -enc_time_base -1 -c copy -f null - </code></pre> Note the time= value at the end of the process.

I&#x27;m bit surprised about lack of financial reward- it can realistically be used to takedown processing servers in rather simple DDoS attack.

Earlier this year people were setting false video metadata to bypass TikTok&#x27;s duration limit and upload very long videos.

Zip bombed Youtube. Nice.

looks like Discord is vulnerable to this too, oopsie

Folks, just because the author wasn&#x27;t wearing a Guy Fawks mask with a black hoodie and made no mention of gaining access to the Central Meme Database, that doesn&#x27;t mean they weren&#x27;t hacking.<p>They were hacking around with MP4 muxers and YouTube. This is definitely the hacker spirit. The word doesn&#x27;t need to be re-appropriated by Hollywood caricatures.