10 ms·
WinRAR zero-day exploited since April to hack trading accounts
- leonidasv 3y agoThe worst part is that WinRAR does not have autoupdate built-in, so millions of people will remain vulnerable for years.
- CamperBob2 3y ago[flagged]
- colejohnson66 3y ago> Given its Russian roots, at this point I'm nervous about updating WinRAR or otherwise continuing to use it. I wish I had a day or two to get 7Zip to build. If you're worried about backdoors, why did it take until this news for you to change your preference? Also, 7zip is available prebuilt; You don't need to compile it yourself.
- chfalck 3y agoI’ve not been able to find a signed distribution of 7-zip, so I imagine they feel safer building the repo locally to make sure they’re at least not running a compromised .exe (not suggesting the code itself is guaranteed to be virus free, but this does feel safer in my mind)
- gabereiser 3y agoapt update && apt install 7zip
- ElectricalUnion 3y ago> I’ve not been able to find a signed distribution of 7-zip Since when would a signed binary help when your "opsec" says it's the software itself that is compromised? Software can still be compromised if it is compromised before being signed. Assuming you somehow trust the source code and not the binary, in fact, you're better off compiling it yourself and checking if the non-signed software you get is similar enough to the binary you can get from others - Assuming of course you can actually reach reliable reproducible builds with a Windows build chain, a thing that last time I checked was horrible and flaky.
- gdy 3y ago[dead]
- Matl 3y ago[flagged]
- cced 3y ago[flagged]
- deleted 3y ago[deleted]
- heap_perms 3y ago> 30 million Americans marched in opposition to the Iraq war And it was an illegal. George W. Bush is a war criminal.
- deleted 3y ago[deleted]
- cynicalsecurity 3y agoThe worst part is to use a closed source proprietary black box software when there are tons of great open source alternatives, such as 7zip or even just plain good old gzip, bzip2, etc.
- MikusR 3y agoThere currently is no alternative to the built in recovery records.
- msh 3y agoThere have been a good open alternative for longer than WinRAR have had recovery records. It's called par files and there are implementations for Mac/win/Linux.
- Strom 3y agoJust to be clear, 7zip, gzip, bzip2 and others all have their own CVE's with arbitrary code execution. Open source software is not immune from these flaws. You can argue for your political beliefs, sure, but let's be honest and not claim that there are any security benefits.
- gorenb 3y agoOpen source does have some security benefits. If billions of (mostly) good people who want to help can read the code, they can find vulnerabilities more easily. Having so many contributors does help.
- Strom 3y agoThat is a popular fantasy story. The reality of almost all open source software is that nobody reads the code and the primary author is struggling to find the time to keep up with maintenance. What's more, doing security review is very hard. You can't just casually read a bit of code. You need to deeply understand the surrounding context. People who have the capability to do that aren't going around providing that service for free. -- More reading for the curious: https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://www.explainxkcd.com/wiki/index.php/2347:_Dependency
- 2OEH8eoCRo0 3y agoAuto update could allow an attacker to push a malicious update to everyone.
- ikekkdcjkfke 3y agoWindows is getting native support for rar, 7zip etc. soon. Of course, like Microsoft Defender, it will also have zero days.
- bobbob1921 3y agowhile, the article does not make this clear, I assume that, when dealing with an infected rar archive, if you right click, and choose extract, the malicious payload does not get executed. It seems you only get infected if you double click a malicious rat archive then within WinRAR, double click one of the legitimate PDF or image files. Either way, it’s a bad scenario - I just would like to know. Tks
- milliams 3y agoIs it really a "zero-day" if it's being used months later?
- wolfi1 3y agoit's a zero-day when it is not patched but still exploited
- dxd 3y agoI think it means that this exploit has been possible since the application was made, the zeroth day.
- efdee 3y agoIt doesn't. Technically, zero-day in the context of exploits means the exploit was circulating and/or being used before the authors of the attacked piece of software were made aware of the vulnerability (or before the vulnerability was made public, or before the day a patch was made available, depending on who you ask).
- arboles 3y agoI can stretch the definition of zero day to make a point. Zero day is a surprise exploit that gets used before it is discovered. WinRAR has not fixed this exploit, and since it's proprietary software we don't even know if the company is even aware or even cares. It's also alike a zero day in the other sense that protections against the exploit haven't been developed. While in a real zero day that's because not enough time has passed for volunteers to develop protections, the case here is proprietary software can't be modified by volunteers.
- deelowe 3y agoNot if the devs weren't aware. Zero day borrows it's terminology from contracts where zero day notice means that no prior notification is needed. A zero day exploit is one that's circulating in the wild prior to their having been a formal disclosure.
- deleted 3y ago
- bandergirl 3y agoOn a related note: Since switching to Mac a long time ago, I’ve come to love both the great support of archives by the OS (and The Unarchiver and more recently Keka) and the way archives are treated: double-click to extract and delete. Exploring archives a-la-WinZIP has made little sense to me since (content previews however would still be helpful)
- deleted 3y ago[deleted]
- qa-tari 3y agoI am not surprised that this default GNOME anti-feature (extract instead of mount or open in File Roller) was also inspired by macOS, which at least has a standard mountable container format. It becomes an annoyance as soon as you encounter your first archive that has no root directory (i.e. most Zip files created on a PC) and fills the parent folder with countless files.
- bandergirl 3y ago> fills the parent folder with countless files macOS unarchivers don't have that issue. Extractions always create a single item: either extract the single item in the archive or create a folder with the archives’s name before extracting. two-files.zip creates two-files/a.txt and two-files/b.txt one-file.zip creates a.txt
- dingi 3y agoOh WinRAR. Before my time ended with Windows 10-12 years ago, this was one of the first programs that I install on a new Windows setup. Feature wise, I haven't seen any tool beat WinRAR. Locking, splitting, recovery support, And my favorite, SFX archives (msi file equivalent). Creating an installation program was dead easy. And they were and still are cool enough to give a perpetual free trial in exchange for a few nagging screens.
- Frost1x 3y ago>Feature wise, I haven't seen any tool beat WinRAR. Locking, splitting, recovery support, And my favorite, SFX archives (msi file equivalent). Creating an installation program was dead easy. Doesn't 7zip do all of this (and quite a bit more)?
- rawgabbit 3y agoI don't know about today. But WinRAR could handle very large files without issue. It would automatically breakup a huge file into a series of smaller compressed files. 7zip AFAIK struggled with larger files. I don't know if things have improved or not.
- kibibu 3y agoThat was my first encounter with RAR in the dos days - multiple volume archives, with each 1.44 filled to the brim.
- technion 3y agoFile sharing sites where you would download 13 .rar files and get yourself a .zip through to .z12 from the set.
- nijave 3y agoNot sure what's considered large but I've created 50-150GiB (after compression) encrypted archives with 7zip just fine
- opello 3y agoDo we know if the unrar command line tool[0] is similarly affected? I can't seem to find anything that says one way or the other. [0] https://packages.debian.org/stable/unrar https://packages.debian.org/stable/unrar
- catboybotnet 3y agoIf you're downloading random files from a stranger's vague post, then I think you had it coming. The file extension spoof fix is nice, however.
- deleted 3y ago[deleted]
- chankstein38 3y agoThis may be a good place to ask this. Legitimate question, why do people still use WinRAR and 7zip and stuff? Zip is built into literally everything. I don't really want to have to download another application to unpack something I get. Is there a good reason? It frequently feels like it's used just to make extra work for the downloader
- WorldMaker 3y agoI use Windows' built-in zip support more often than not, but 7zip is still handy as a "debug tool" when Windows gives up on a zip, or when I know a file is a zip but has a different extension and for whatever reason I don't want to rename it in that moment (skim something out of a DOCX file, for instance). Also, a common gesture I use is 7zip's extensions to the right-click drag file operation. I can select an entire collection of zip files right-click drag it to a different folder and "Extract to *\" which decompresses all the files into a set of folders (under the folder you are dragging into) using the names of the zip files as the folder names (minus the extension). This is a useful and surprisingly common operation. (For instance, downloading a bunch of Bandcamp albums on a Bandcamp Friday and decompressing them all at once to a music library folder.)
- WorldMaker 3y agoFurther tangent: my company still pays the zombie remains of Corel for WinZIP licenses and that astonishes me. WinZIP is slow and really doesn't seem to offer much over Windows built-in support, plus it still "kindly" clobbers the built-in support (on every reinstall/upgrade) removing it from the default and subtly breaking it (which I find quite irritating). It uselessly bloats Windows File Explorer tooltips and dialogs. (Why do I care what some subset of filenames inside the zip file are?) It doesn't seem to offer any useful tools, and its user interface is ugly, slow, and prone to crashing. WinZIP should probably have died in the 90s.
- CamperBob2 3y agoBecause some people, for reasons known only to themselves, still insist on using .tar files in 2023.
- ChrisArchitect 3y agoRelated recent other vulnerability from last week: https://news.ycombinator.com/item?id=37179505 https://news.ycombinator.com/item?id=37179505
- iav 3y agoWinRAR is (was?) developed in Russia, so it always seemed like a great way for the Russian FSB to hack foreign systems.
- fomine3 3y ago7-zip too. It seems that there are capable Russians about data compression.
- deleted 3y ago[deleted]
- xxpor 3y agoTIL, I was thrown off by the fact that it's a GmbH into thinking they were German.
- SillyUsername 3y agoWell this seems to suggest they're German https://www.win-rar.com/cookies.html?&L=0 https://www.win-rar.com/cookies.html?&L=0 The original author Eugene Roshal (iirc) isn't.
- nirui 3y agoHow is that conclusion came to mind? Did they wrote the entire code in Russian or the code just don't run on Russian computers? If you don't know, this is not even the first file compression related exploit. "Zip Slip"(0) for example, is just one year old, and there are many of them out there. [Zip Slip]: https://nvd.nist.gov/vuln/detail/CVE-2022-21675 https://nvd.nist.gov/vuln/detail/CVE-2022-21675
- jwilk 3y ago"Zip Slip" was a term made up in 2018 (see https://news.ycombinator.com/item?id=17237295 https://news.ycombinator.com/item?id=17237295) for a class of vulnerabilities that's been known since at least 2001.
- LinuxBender 3y ago
- getarofilter 3y ago[dead]