6 ms·

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were revers

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore vulnerable itself. Still not sure, though. The way the stylesheet makes the "rendered" form (especially section headings) resemble markdown source is pretty neat.

arka2147483647 9y ago
It's common knowledge that AV programs scan files inside compressed archives. Obviously you need to run the decompression code to do that.
- blattimwind 9y ago
  It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").
  - katastic 9y ago
    I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome-engineer-says-windows-defender-the-only-well-behaved-antivirus-cites-tons-of-empirical-data https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Android and iOS, I don't see how an anti-virus suite could ever win the battle against a user intentionally installing a virus. (Of course, desktop apps are a different ballpark than web apps/websites where you're merely connecting to a website vs installing a dedicated application with filesystem access.)
    - alkonaut 9y ago
      I don’t think I know of windows users that use anything other than defender these days on their personal machines, but I (am forced to) use McAfee on my work machine. I suspect that the enterprise tooling is better for third party AV and that’s the only thing other than inertia keeping corporate desktops on those old AV products.
    - katastic 9y ago
      Addendum: Anyone remember GStreamer being a Linux vulnerability because it had a 6502 CPU emulator to run... NES music files, and hackers managed to jump outside of the VM. https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromising-linux-desktop.html https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit... It makes me wonder how easy it is to break out of a particular anti-virus vendor's VM, in a vulnerability that wouldn't exist if you weren't even running AV (outside Defender) at all.
    - sp332 9y ago
      While I think that's a pretty reasonable approach to antivirus these days, Defender was one of the scanners that was doing that. https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/ https://arstechnica.com/information-technology/2017/05/windo...
    - hutzlibu 9y ago
      My experience so far (helped maintain lots of non IT people's computers) was also, that the performance gain from removing antivirus software (and just using defender) was worth the theoretically less protection.( If even so) Besides, with the behavior of most free Antivirus I could not really distinguish from common spyware. Everything needs to call home these days ... So when friends ask me if this computer is now virus/spyware free .. they are usually a bit disappointed when I tell them, probably not, even if we delete everything and remove windows (but it would help). But most people, including me, need windows from time to time, so it's allways a compromise. But common (free) Antivirus is really just snake oil.
      - proactivesvcs 9y ago
- carussell 9y ago
  I don't know what this comment contributes to the conversation besides being vaguely condescending. I didn't ask why an AV product would be re-using 7-zip code.
landave 9y ago
You are completely right with the first comment. The antivirus product itself reuses parts of 7-Zip and is vulnerable itself. I mentioned this mainly because I did not analyze the original 7-Zip software, but only discovered that it was affected as well after I had found the bug in this antivirus product. I admit that this is confusing, so I'll probably try to rephrase this.
- woodson 9y ago
  Seems like a possible license violation then (7-Zip is LGPL).
  - ciupicri 9y ago
    LGPLG is let's you use a library without distributing the source code of the whole program.
    - Laaas 9y ago
      Read section 4 of https://www.gnu.org/licenses/lgpl-3.0.en.html https://www.gnu.org/licenses/lgpl-3.0.en.html, there are some things you still have to do.
Promarged 9y ago
> The way the stylesheet makes the "rendered" form (especially section headings) resemble markdown source is pretty neat. As far as I see it's just section headers, but I agree the stylesheet is very nice. The section header prefix (###) could be an anchor to the section though (<a href="#section">).

arka2147483647 9y ago

It's common knowledge that AV programs scan files inside compressed archives. Obviously you need to run the decompression code to do that.

blattimwind 9y ago
It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").
- katastic 9y ago
  I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome-engineer-says-windows-defender-the-only-well-behaved-antivirus-cites-tons-of-empirical-data https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Android and iOS, I don't see how an anti-virus suite could ever win the battle against a user intentionally installing a virus. (Of course, desktop apps are a different ballpark than web apps/websites where you're merely connecting to a website vs installing a dedicated application with filesystem access.)
  - alkonaut 9y ago
    I don’t think I know of windows users that use anything other than defender these days on their personal machines, but I (am forced to) use McAfee on my work machine. I suspect that the enterprise tooling is better for third party AV and that’s the only thing other than inertia keeping corporate desktops on those old AV products.
  - katastic 9y ago
    Addendum: Anyone remember GStreamer being a Linux vulnerability because it had a 6502 CPU emulator to run... NES music files, and hackers managed to jump outside of the VM. https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromising-linux-desktop.html https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit... It makes me wonder how easy it is to break out of a particular anti-virus vendor's VM, in a vulnerability that wouldn't exist if you weren't even running AV (outside Defender) at all.
  - sp332 9y ago
    While I think that's a pretty reasonable approach to antivirus these days, Defender was one of the scanners that was doing that. https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/ https://arstechnica.com/information-technology/2017/05/windo...
  - hutzlibu 9y ago
    My experience so far (helped maintain lots of non IT people's computers) was also, that the performance gain from removing antivirus software (and just using defender) was worth the theoretically less protection.( If even so) Besides, with the behavior of most free Antivirus I could not really distinguish from common spyware. Everything needs to call home these days ... So when friends ask me if this computer is now virus/spyware free .. they are usually a bit disappointed when I tell them, probably not, even if we delete everything and remove windows (but it would help). But most people, including me, need windows from time to time, so it's allways a compromise. But common (free) Antivirus is really just snake oil.
    - proactivesvcs 9y ago
carussell 9y ago
I don't know what this comment contributes to the conversation besides being vaguely condescending. I didn't ask why an AV product would be re-using 7-zip code.

landave 9y ago

You are completely right with the first comment. The antivirus product itself reuses parts of 7-Zip and is vulnerable itself. I mentioned this mainly because I did not analyze the original 7-Zip software, but only discovered that it was affected as well after I had found the bug in this antivirus product. I admit that this is confusing, so I'll probably try to rephrase this.

woodson 9y ago
Seems like a possible license violation then (7-Zip is LGPL).
- ciupicri 9y ago
  LGPLG is let's you use a library without distributing the source code of the whole program.
  - Laaas 9y ago
    Read section 4 of https://www.gnu.org/licenses/lgpl-3.0.en.html https://www.gnu.org/licenses/lgpl-3.0.en.html, there are some things you still have to do.

Promarged 9y ago

> The way the stylesheet makes the "rendered" form (especially section headings) resemble markdown source is pretty neat. As far as I see it's just section headers, but I agree the stylesheet is very nice. The section header prefix (###) could be an anchor to the section though (<a href="#section">).