3 ms·

“A current trend in cookie theft malware distribution is packaging malicious software in an encrypted archive—a .zip, .7z, or .rar file, protected by a password

“A current trend in cookie theft malware distribution is packaging malicious software in an encrypted archive—a .zip, .7z, or .rar file, protected by a password—which hides file contents from Safe Browsing and other antivirus detection scans. […] Attackers often make the passwords to encrypted archives available in places like the page from which the file was downloaded, or in the download file name. For Enhanced Protection users, downloads of suspicious encrypted archives will now prompt the user to enter the file's password and send it along with the file to Safe Browsing so that the file can be opened and a deep scan may be performed” So, what group of users will actually do that? They’d have to a) know they got a suspicious file, b) know how to find its password, and then c) upload it to Google. I think b) definitely is too hard for most users. Chances are quite a few will send their own password instead. Also, if Chrome can prompt the user for the password, and it is “available in places like the page from which the file was downloaded, or in the download file name”, why can’t Chrome look there for that password? I bet Google’s engineers can write something that’s better at that than the average user. Edit: There’s a slight security risk there, but Chrome could also decrypt the file locally and keep the password on the local system, couldn’t it?

omoikane 2y ago
> They'd have to a) know they got a suspicious file, b) know how to find its password, and then c) upload it to Google. One scenario might be: 1. Some dodgy website A hosts a file on a different file uploader website B. 2. File is encrypted with some password that's visible on website A, but not visible to any other website that hotlinks to the file on website B. 3. User visiting website A has some idea of what they might find in the file that they just downloaded, but because website A has a dodgy reputation, and Chrome offered to check the downloaded file on their behalf, they then willingly submit the password that was found on website A. Users do #3 because it's convenient. Also, they would be protected from whatever bug that might have been triggered on extraction. Though personally what I would do is download the file, extract it locally, and scan it locally. Assuming that I trusted the website in the first place.
JohnFen 2y ago
> I think b) definitely is too hard for most users. Since the person downloading the file can't unpack it without knowing that password themselves, if finding the password is too difficult for them then they're already protected from the archive's contents.

omoikane 2y ago

> They'd have to a) know they got a suspicious file, b) know how to find its password, and then c) upload it to Google. One scenario might be: 1. Some dodgy website A hosts a file on a different file uploader website B. 2. File is encrypted with some password that's visible on website A, but not visible to any other website that hotlinks to the file on website B. 3. User visiting website A has some idea of what they might find in the file that they just downloaded, but because website A has a dodgy reputation, and Chrome offered to check the downloaded file on their behalf, they then willingly submit the password that was found on website A. Users do #3 because it's convenient. Also, they would be protected from whatever bug that might have been triggered on extraction. Though personally what I would do is download the file, extract it locally, and scan it locally. Assuming that I trusted the website in the first place.

JohnFen 2y ago

> I think b) definitely is too hard for most users. Since the person downloading the file can't unpack it without knowing that password themselves, if finding the password is too difficult for them then they're already protected from the archive's contents.