3 ms·
Can anyone explain if the title and vague explanation is really true? Malicious ZIPs implies to most that simply opening the ZIP, perhaps with a particular ZIP
by nbevans 10y ago
Can anyone explain if the title and vague explanation is really true? Malicious ZIPs implies to most that simply opening the ZIP, perhaps with a particular ZIP archive tool, is sufficient to cause infection. If this is the case then it's a 0-day and this fact needs reporting and analysing separately from all the noise regarding WikiLeaks.
- wjnc 10y agoThat would be a nice ML application for fun and profit! Predict infected files. Cross with known infectations. Submit all others. Collect bounty? In more seriousness. It still would be a hard problem. You never know for certain which files are safe and which harbour 0-day exploits. I guess you do know what textual contents in these emails are 'normal' and which are not (although it's in Turkish), so you could say obvious attempts at fishing-with-attachments are probably infected. Plus that not all virusscanners would recognize all infectations.
- andwur 10y agoThey appear to all be regular ZIP files that contain malware as opposed to ZIP files that are themselves malware.
- Bartweiss 10y agoA more accurate summary would be "Wikileaks releases many AKP emails, including lots of received spam. Some of the spam has ZIP files containing malware." So good question, and it looks like the answer is this isn't a novel attack, just normal malware-spam and an imprecise summary.
- nbevans 10y agoA load of fuss about nothing then :)