7 ms·

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and downlo

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without worry to what type of filesystem and decompression software I use?

adamnemecek 10y ago
What exactly do you mean by more robust malicious file? Like an executable? Because I'm relatively OK with extracting files from dubious sources, I'm not OK with running executables from dubious sources.
- kbenson 10y ago
  Yes, there are trust levels associated with running untrusted code, and processing untrusted data. It's possible (but often hard and annoying) to access some external/untrusted resources such as the internet and items on them without running untrusted code, it is not possible to do so without processing untrusted data (at a minimum it's going to traverse your network stack and display/disk drivers).
lqdc13 10y ago
Many people put more trust in unzipping something than running untrusted code. Archives are supposed to be read only.
excalibur 10y ago
Because Henry is Hardcore.
laumars 10y ago
The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which means if someone wanted to view ala DVD ".iso" which used the UDF specification, then they could be vulnerable if they use 7-zip. I remember it used to be common place to open .iso files with WinRar back in the 90s. I wouldn't be surprised if a sizeable number of people now use 7-zip similarly
- paulfr 10y ago
  I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface. EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file extension matches a known format but 7-zip is about to run a decoder for a different format.
  - colejohnson66 10y ago
    IIRC, 7-zip does tell you if the actual format is different. At least it does when I extract some DMGs; it tells me it's actually an HFS "file".
    - paulfr 10y ago
      Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
      - colejohnson66 10y ago
        I meant when right clicking the archive am choosing "Extract to..." or something using Explorer's context menu.
        paulfr 10y ago
        Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.

adamnemecek 10y ago

What exactly do you mean by more robust malicious file? Like an executable? Because I'm relatively OK with extracting files from dubious sources, I'm not OK with running executables from dubious sources.

kbenson 10y ago
Yes, there are trust levels associated with running untrusted code, and processing untrusted data. It's possible (but often hard and annoying) to access some external/untrusted resources such as the internet and items on them without running untrusted code, it is not possible to do so without processing untrusted data (at a minimum it's going to traverse your network stack and display/disk drivers).

lqdc13 10y ago

Many people put more trust in unzipping something than running untrusted code. Archives are supposed to be read only.

excalibur 10y ago

Because Henry is Hardcore.

laumars 10y ago

The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which means if someone wanted to view ala DVD ".iso" which used the UDF specification, then they could be vulnerable if they use 7-zip. I remember it used to be common place to open .iso files with WinRar back in the 90s. I wouldn't be surprised if a sizeable number of people now use 7-zip similarly

paulfr 10y ago
I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface. EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file extension matches a known format but 7-zip is about to run a decoder for a different format.
- colejohnson66 10y ago
  IIRC, 7-zip does tell you if the actual format is different. At least it does when I extract some DMGs; it tells me it's actually an HFS "file".
  - paulfr 10y ago
    Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
    - colejohnson66 10y ago
      I meant when right clicking the archive am choosing "Extract to..." or something using Explorer's context menu.
      - paulfr 10y ago
        Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.