10 ms·
7zip.com Is Serving Malware
- deleted 8mo ago[deleted]
- throawayonthe 8mo agoi'm increasingly convinced nothing good ever comes from youtube tutorials
- whatwhaaaaat 8mo agoThe recent openclaw videos are the best. “Ten openopenclaw skills that will change your life!” Ends up being useless YouTube metrics and a glorified egg drop.
- NooneAtAll3 8mo agoremember when we could downvote the bad ones?
- tokyobreakfast 8mo agoDoes the 7-Zip author still refuse to digitally sign or even provide hashes of the official downloads? It's an extremely weird flex, he thinks it's a frivolous waste of time or something.
- giancarlostoro 8mo agoDo people even double check installers are digitally signed? There's so much open source stuff out there that is not digitally signed, most people might not even notice.
- tokyobreakfast 8mo agoWindows has displayed a big scary orange prompt for at least the last decade when it isn't. More like 15-20 years IIRC. But I'm sure people blindly click through the "Unknown author" prompt just as they would ignore a certificate error.
- giancarlostoro 8mo agoLike I said, theres a LOT of open source projects that show that prompt. Signing an MSI involves having a valid CA certificate, which AFAIK is not free, and goes beyond the budget of most projects.
- tokyobreakfast 8mo agoIt's not free but it's not expensive either. Most well known Windows open source projects have them; e.g. PuTTY, Wireguard, VLC, Rufus, etc. Maybe it's high time for a free-as-in-beer CA for non-profit open source developers funded by donations? Edit: I was wrong. Prices on code signing certificates have skyrocketed to in excess of $500/year, due in part to continuing meddling by the CA/B forum which increased the requirements of standard certs to be the same as EV certs, and requiring the key to be stored in a hardware token—which must now be re-issued yearly. This makes it near impossible to provide free or affordable certificates to developers. Thanks CA/B forum, lots of help as usual.
- JohnTHaller 8mo agoWe're up for renewal with PortableApps.com. The same one year non-EV code signing certificate with a USB token that was US$246 last year is now US$434 from GlobalSign. The lower prices you see some places are for 2+ years. Note that the certificate itself is only for 1 year regardless of how long you buy one for and you need to go through the renewal process each year just without payment.
- rustyhancock 8mo agoOrange? It's a blue warning isn't it? Is this how one of us finds out he's colour blind?
- tokyobreakfast 8mo agoBlue when it has a valid signature. Orange when it's missing or invalid.
- fuzzy2 8mo ago
- ozim 8mo agoI use winget or homebrew, those tools do so for me and if something doesn't match they show an error.
- fuzzy2 8mo agoNeither WinGet nor Homebrew packages/formulae provide authenticity checks. They have integrity checks for file transfer. That’s it. Where did the file come from when it was entered into the respective repository? No statement. Whether Authenticode provides a sufficient authenticity check is yet another question, of course. Still, file integrity verification is just a side-effect.
- jsheard 8mo agoHe's always been an odd one, for a long time he refused to enable even basic hardening features like ASLR and DEP because they made the executables slightly larger. He eventually relented on some of those, but last I heard the more advanced mitigations like HE-ASLR, CFG and GS were still disabled.
- mirashii 8mo agoEven more, there are regularly security vulnerabilities patched in releases that don't get CVEs and don't get any mention in patch notes, there are no incremental commits between releases, just giant code dumps. There's no changelog linked on the 7-zip.org website. There's no auto-update or update check mechanism, which is problematic for a project with regular CVEs whose primary purpose is handling untrusted inputs. 7-zip is not a serious project and its use should be strongly discourged.
- reddalo 8mo agoI migrated from 7-Zip to NanaZip, a fork with modern Windows features that the original developer refuses to implement. https://github.com/M2Team/NanaZip https://github.com/M2Team/NanaZip
- baal80spam 8mo agoWhenever I see "modern Windows experience", it always turns to be worse than the original one.
- deltastone 8mo agoI would agree normally, but this one is a nice change and upgrade, actually.
- dlcarrier 8mo agoWell yeah, it says "modern" not "better". Modern Windows and OS X and Android and iOS are all worse than the old ones.
- margalabargala 8mo agoI take your point, and usually you're right, but in this case "modern features" includes things like having an "extract" button show up when you right click an archive file in Explorer.
- fuzzy2 8mo agoYou can have that, and in an even better way: Simply disable the blight that is Windows 11 context menus and go back to real context menus. I’m not even joking, they are basically superior in every way. They open faster, they have only one visual axis and they support all the shell extensions you remember. (Too many shell extensions could make them just as slow though.)
- baal80spam 8mo agoOK, I had no idea Windows 11 doesn't have it. I am on Windows 10, and then it's Linux/MacOS for me.
- Dwedit 8mo ago7zip.com has never been the official website of the project. It's been 7-zip.org
- pibaker 8mo agoHow can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?
- antisthenes 8mo ago> How can the average 7zip user know which one it is? I dunno, if you type "download 7zip" into Google, the top result is the official website. Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website. This is actually a pretty good case of the regular user being pretty safe from downloading malware.
- sedatk 8mo ago> I dunno, if you type "download 7zip" into Google, the top result is the official website. Until someone puts an ad above it.
- 8organicbits 8mo agoSure, but the answer to "How can the average 7zip user know which one it is?" would then be "do a Google search and use uBlock Origin".
- pixl97 8mo agoHow does the user know they are using the official uBlock Origin?
- Meneth 8mo agoI compared https://7-zip.org/a/7z2600-x64.exe https://7-zip.org/a/7z2600-x64.exe with https://7-zip.com/a/7z2600-x64.exe https://7-zip.com/a/7z2600-x64.exe. They are byte-for-byte identical. If there's malware, it isn't obvious.
- high_na_euv 8mo agoIt doesnt help that many services use a few domain names, bonus points if other ones look like from scam domain examples
- throwaway150 8mo agoI tested with the 3 major browsers and all 3 block it as "Suspected Phishing". So looks like the system is working as designed. Lookalike websites serving malware have always existed. So this isn't exactly news. But the browsers are blocking them like they should.
- chalion 8mo agoWeirdly, in Firefox 7zip.com is blocked but www.7zip.com isn't. If you type '7zip' in the address bar and then press Ctrl+Enter to go to the address, you'll get owned, because that key-combo adds the www at the beginning.
- deleted 8mo ago[deleted]
- pentagrama 8mo agoYes, and I think this case gets somewhat more notoriety because the phishing site has the .com domain and the legitimate one has a .org. Like it or not, .com adds perceived trustworthiness and works as a branding signal, especially in these times of VCs throwing large amounts of money at branding and buying 3 to 6 letter .com domains, but a small project like 7zip cannot afford that kind of expense.
- jas39 8mo agoI would not trust any sw from Russia. Could be a vector for the FSB. I'm sure they have thought about it.
- jan_Sate 8mo agoThe same could be said for software from the US. Could be a vector of CIA. For average US citizens, it might even be safer to use Russian software because FSB can't come after them.
- n4bz0r 8mo agoFunny thing that it's exactly the same for Russian citizens - they'd rather use US government malware. Same goes for mail providers.
- einpoklum 8mo agoIt is not a bad rule, to use online services / software where you know that the malicious owners are likely not after you nor in cahoots with the government where you live. Or you can take the Swiss option with stuff like ProtonVPN, Signal etc. :-)
- ale42 8mo agoSignal is not Swiss, though, although I'd like they to be ;-)
- deleted 8mo ago[deleted]
- bloaf 8mo agoI've started using winget to install my apps for exactly this reason. I can't keep track of every url for every piece of software.
- ptx 8mo agoIs that safe? Microsoft's policy [1] seems to say that anyone can publish an update to a package as long as it passes "an automated process" which checks that it's "not known to be malicious". [1] https://learn.microsoft.com/en-us/windows/package-manager/package/repository https://learn.microsoft.com/en-us/windows/package-manager/pa...
- fuzzy2 8mo agoIt’s not. And it gets worse. A WinGet package can suddenly be introduced for software you have already installed and then the next "update all" will install whatever. Could be something completely different! WinGet is not only unreliable, it is but one step removed from Remote Code Execution as a Service. Well, maybe one-and-a-half, if package repo maintainers were to pay attention, but that’s not realistic.
- bloaf 8mo agoIt would have prevented both this 7zip attach and the recent notepad++ one.
- krypd0h 8mo agoThe links to the file downloads on 7zip.com all point to 7-zip.org. Example: https://www.7-zip.org/a/7z2501-x64.exe https://www.7-zip.org/a/7z2501-x64.exe Did they change it because of the negative publicity (Reddit) and will probably change back soon to the malware links?
- chalion 8mo agoMaybe that's how they don't get banned by their hosting provider. Once reports start coming in, they pretend to be a honest establishment.
- _slih 8mo ago[dead]
- MuffinFlavored 8mo ago> Your machine runs a little slower, your bandwidth gets a little thinner, and someone halfway around the world is routing traffic through your home IP. I wish in 2026 the default on new computers (Windows + Mac) was not only "inbound firewall on by default" but also outbound and users having to manually select what is allowed. I know it is possible, it's just not the default and more of a "power user" thing at the moment. You have to know about it basically.
- TomatoCo 8mo agoAs a power user I agree, but how do you avoid it being like the Vista UAC popups? Everyone expects software to auto update these days and it's easy enough to social engineer someone into accepting.
- tempest_ 8mo agoEven if it was a default there is so many services reaching out the non-technical user would get assaulted with requests from services which they have no idea about. Eventually people will just click ok with out reading anything which puts you back at square one with annoying friction.
- ForceBru 8mo agoI use LuLu (https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html) to block outgoing connections and manually select which connections/apps are allowed. It's free and works just fine.
- atmanactive 8mo agoFort Firewall for the win. https://github.com/tnodir/fort https://github.com/tnodir/fort
- 1vuio0pswjnm7 8mo agoI do this outbound filtering but I don't use a computer running Windows or MacOS to do it It doesn't make sense to expect the companies promoting Windows or MacOS to allow the user to potentially interfere with their "services" and surveillance business model Windows and MacOS both "phone home" (unfiltered outgoing connections). If computer owners running these corporate OS were given an easy way to stop this, then it stands to reason that owners would stop the connections back to the mothership. That means loss of surveillance potential and lost revenue As of 2006, still nothing stops anyone from setting the gateway of their computer running a corporate OS to point to a computer running a non-corporate OS that can do the outbound filtering
- wowczarek 8mo agoThe .com site serving malware aside, it's how people even get to downloading this. PC builder [...], USB stick [...], YouTube tutorial for a new build [...] instructed to download. Makes me wonder, is this how "PC builders" build PCs, or was this a regular user person. Archive managers are such basic software that I'd think surely someone would keep a stash of (trusted) installer files for the basic tools to be installed in a new environment. At least that's what we used to do, like, 25 years ago. Or use choco, winget or whatever. Malware hygiene habits remain almost unchanged - don't click that link.
- mmh0000 8mo agoThis has been a long-standing problem with 7-Zip. An article from 2018: https://www.bleepingcomputer.com/news/security/fake-websites-for-keepass-7zip-audacity-others-found-pushing-adware/ https://www.bleepingcomputer.com/news/security/fake-websites... And uBlock Origin's "Badware" filter blocks it: https://github.com/uBlockOrigin/uAssets/blob/master/filters/badware.txt#L6350 https://github.com/uBlockOrigin/uAssets/blob/master/filters/...
- usr1106 8mo agoIt says the code signing cert has been revoked by now. How does verification work? Only at installation time or will it prevent running the installed files later if installation happened when the cert was still accepted? Linux user asking out of curiousity...
- NameNickHN 8mo agoI always go through Wikipedia if I want to download software for this exact reason.
- pendingrunner 8mo agoI usually check some other reliable source for official web address. Earlier I used Wikipedia. Recently found out Softorage, so using that nowadays.
- ruicraveiro 8mo agoAs a Linux user, used to get all of my software either through the distro's repository or Flathub, having to download software from sites when I run Windows makes me feel really queasy.
- FireInsight 8mo agowinget ftw
- Bender 8mo agoThe only solutions for the malicious domain would be lawsuits or hactivism. As others have said it is blocked in uBlock by default which everyone should be using at a bare minimum.
- phucnet 8mo ago[dead]