Are MovieTextures dangerous?

Unity Engine
1

I’ve been thinking that MovieTextures are dangerous for a while now, but the documentation has been updated so I’m wondering what others think. Longer explanation below, but tl;dr you need Quicktime to import videos, but having Quicktime on a Windows machine is a security risk.

But why would movie textures be dangerous?
You must have quicktime to play movie textures, and QuickTime is no longer supported by Apple on Windows, so it is a major threat to the security of your computer to even have QuickTime installed. Below are some resources.

According to the MovieTexture scripting API page: “Video files are imported via Apple QuickTime. Supported file types are what your QuickTime installation can play (usually .mov, .mpg, .mpeg, .mp4, .avi, .asf). On Windows movie importing requires Quicktime to be installed”

According to The Verge (and other sources, you can google it): “The Department of Homeland Security has advised that PC owners uninstall Apple’s QuickTime for Windows, after two vulnerabilities were discovered in its code” … “remove the software entirely, or else risk loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets.”

2

This is a very interesting question. Quicktime is dangerous (shows how Apple cares about their customers), so I wouldn’t install it. I guess you’d have to find another tool to make an animation from a movie. I’m about to run into this problem as I’d like to add a trailer to my game. I think Unity will have to fix this on their end as I don’t see why Quicktime is required.

At the moment if you want to do this safely, I’d do one of 2 things:

A: Download QuickTime and Unity and run in a virtual machine. Slow, but safe.
B: Download Quicktime, then disconnect from the internet. Do my work, uninstall Quicktime and reconnect.

While inconvenient, those are the only ways I see to stay safe.

3

And the manual prompts to you download Quicktime and gives you a link that is no longer valid. I think this functionality needs some sort of updating.

4

Agreed, this looks like an ancient part of Unity.

If you want to take the risk, here’s a working link: http://downloads.tomsguide.com/QuickTime,0301-31.html

And another link: http://quicktime.en.softonic.com/

After installing I recommend disconnecting from the internet immediately, and not reconnecting until Quicktime is uninstalled. Time for Unity to fix this!

5

Aside from plugins to playback various formats in various ways (there are a few on the Asset Store), Unity know their native support is lacking and are finally looking improve things. Roadmap Alpha, last item;

Video: New API
Deprecating MovieTexture and providing a new video playback engine API targeting hardware decoding on platforms.

6

Thanks for the replies, it seems we should avoid MovieTextures until the new video API comes out. I figured MovieTextures should be avoided, but I wanted to double check before I continue spreading the news on the forums (where appropriate). I was also looking to make sure the Unity team noticed, and it looks like they have.

cool idea, but I think the user also needs quicktime installed (I remember having to install quicktime to play the Unity game “Shad-O” from steam back in 2012).

Very good to know, thanks!

7

Why not just use Ogg Theora format directly, so there wouldn’t be any conversion necessary.

–Eric

8

Without quicktime installed, how do you actually use the *.ogv movie though, as its not showing up as something usable in Unity. Thanks