用電腦、電視、電話媒體播放器下載字幕有可能中招，盡可能下載最新版媒體播放器，如果有的話。

Hacked in Translation – from Subtitles to Complete Takeover
by Check Point Research Team posted 2017/05/23

What’s the effect?

Scope: The total number of the affected users is in the hundreds of millions. Each of the media players found to be vulnerable to date has millions of users, and we believe other media players could be vulnerable to similar attacks as well. VLC has over 170 million downloads of its latest version alone, which was released June 5, 2016. Kodi (XBMC) has reached over 10 million unique users per day, and nearly 40 million unique users each month. No current estimates exist for Popcorn Time usage, but it’s safe to assume that the number is likewise in the millions.

Damage: By conducting attacks through subtitles, hackers can take complete control over any device running them. From this point on, the attacker can do whatever he wants with the victim’s machine, whether it is a PC, a smart TV, or a mobile device. The potential damage the attacker can inflict is endless, ranging anywhere from stealing sensitive information, installing ransomware, mass Denial of Service attacks, and much more.

http://blog.checkpoint.com/2017/05/23/hacked-in-translation/

Proof-of-Concept video

唔知大家有冇聽過clickjacking，基本上所有android 去到7.1.2都有潛在危機，要今年第三季android O先解決到。

'Cloak and Dagger' attacks could be the biggest security threat facing Android'This is as dangerous an attack as we could possibly describe' expert warns.

By Jason Murdock, May 23, 2017 12:21 BST

"Users need to be careful about the permissions that new apps request," Lee said, adding: "If there are very broad permissions, or the permissions don't seem to match what the app is promising to do, you need to be sure you really need that app.

"Apps from name-brand sources such as Facebook, Uber and Skype should be okay. But with a random game or free versions of paid apps that you might download, you should be very careful. These features are very powerful and can be abused [...] without you knowing."

http://www.ibtimes.co.uk/cloak-dagger-attacks-could-be-biggest-security-threat-facing-android-1622962

Demos
Invisible Grid Attack 

美加嘅朋友用ATM就要小心d，因為你地應該未轉曬用EMV，所以要小心d微型skimmers同內置式skimmer。

微型skimmers同鏡頭
Would you notice an ATM skimmer?
Jim Stickley, May 30, 2017