19-Year-Old WinRAR Vulnerability Leads To Over 100 Malware Exploits (slashgear.com) 144
"Last month it was discovered that WinRAR, software used to open .zip archive files, has been vulnerable for the last 19 years to a bug that's easily exploited by hackers and malware distributors," writes SlashGear. A Slashdot reader quotes their report:
Check Point, the security researchers that revealed the WinRAR bug, explain that the software is exploited by giving malicious files a RAR extension, so that when opened they can automatically extract malware programs. These programs are installed in a PC's startup folder, allowing them to start running anytime the computer is turned on, all without the user's knowledge.
Once the bug was disclosed, however, hacker groups really began using it to their advantage, with various nations becoming the target of state-backed cyber-espionage campaigns attempting to collect intelligence. The latest comes from McAfee, the software security firm, which notes that it has identified over 100 unique exploits that use the WinRAR bug, most of them targeting the U.S.
WinRar 5.70, released in late January, patches the behavior, but "it must be manually downloaded and installed from the website, leaving most users unaware of the critical update," the article warns.
It also estimates that during the last 19 years WinRar has been downloaded over 500 million times.
Once the bug was disclosed, however, hacker groups really began using it to their advantage, with various nations becoming the target of state-backed cyber-espionage campaigns attempting to collect intelligence. The latest comes from McAfee, the software security firm, which notes that it has identified over 100 unique exploits that use the WinRAR bug, most of them targeting the U.S.
WinRar 5.70, released in late January, patches the behavior, but "it must be manually downloaded and installed from the website, leaving most users unaware of the critical update," the article warns.
It also estimates that during the last 19 years WinRar has been downloaded over 500 million times.
Re: (Score:1)
That's a heckuva lot of downloads.
"It also estimates that during the last 19 years WinRar has been downloaded over 500 million times."
And dozens of people have bought it.
Re: (Score:2)
https://otland.net/threads/goo... [otland.net] (SFW)
Re: (Score:2)
Re: (Score:1)
Well 7-Zip is open source and it's not affected.
On another note, I don't understand why anyone would use WinRAR. 7-Zip is superior in every way.
Re: (Score:1)
Anyone who willingly creates a rar file deserves to get owned by Winrar bugs.
Re: (Score:2)
The problem is rar.
Re: (Score:2)
You said as if WinRAR has no choice of their library. Hmm... Who made the decision to use the library then? Not WinRAR? Then they can't find an alternative after knowing the bug? Yeah right.
Re: (Score:2)
If WinRAR were open source, this would never have happened!
In this case the problem was libace being closed source (-ish), at least they used an old unmaintained binary of libace, instead of dropping it or using a maintained open source version.
Meh (Score:4, Insightful)
I use 7-zip. Haven't installed WinRAR in like a decade.
Re: (Score:2)
Re: (Score:3)
I wished 7-zip would let me extract multiple highlighted files into their own (directorie/folder)s like WinRAR which is why I still use it. :(
Re: (Score:1)
You can do it by selecting the option "Extract to /*", works like WinRAR
Re: Ooook (Score:1)
Re: (Score:2)
Re: (Score:2)
The Windows zip support is a bit like having just neutered animals on a farm and expect them to procreate.
Anyway - this posted on Slashdot was actually pretty informative anyway since I have now updated my Winrar installation.
This isn't hard... (Score:5, Informative)
WinRAR was shipping a proprietary free-as-in-beer DLL to uncompress ACE archive format files.
WinRAR uses 'magic' to detect file types so malware authors are naming archives '.rar' to get it to WinRAR which then passes it into the vulnerable DLL where it uses a path traversal exploit to install malware.
Since nobody uses ACE format files anyway the WinRAR authors dropped support and removed the DLL.
Users need to update and Windows doesn't make that easy like linux distros do.
Maybe it's just me but I find the vague and nebulous "popular" articles to be confusing and hard to read.
Re: (Score:2)
Maybe it's just me but I find the vague and nebulous "popular" articles to be confusing and hard to read.
Maybe because the reporters don't understand what they are writing about.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
He means the package mangers of any Linux distro updates everything for him. Any program on Windows except the OS doesn't update unless the program does it by itself.
Re: (Score:2)
Users need to update and Windows doesn't make that easy like linux distros do.
This isn't actually true with Windows 10. It does have a built-in package manager that is capable of installing & updating packages from Chocolatey, GitLab repositories, etc..... and it has the Microsoft Store, which has an auto-update mechanism and is perfectly capable of supporting classic Win32 programs like WinRAR, including the command-line version. (Yes, console apps in the MS Store is a thing nowadays.)
Problem is.... nobody really seems to know any of this. This is mostly Microsoft's fault sin
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Nope. You are most likely the only one.
Glad they fixed it, won't touch 7zip. (Score:3)
Had multiple archives which were reporting as corrupt / damaged in 7zip and opened fine in WinRAR, near a decade ago.
Had I followed the advice of 7zip I could have discarded perfectly good data.
I reported the bug YEARS ago, supplied files too, nope no interest from the developers.
I spoke with someone yesterday with someone who said the same thing is STILL going on.
Nope, I don't have faith in 7zip, working with the data reliably is the #1 thing for me. I'll stick with a patched WinRAR thanks.
Re: (Score:1)
I too have had files that did not open in 7zip.
Every last one was a corrupt zip file. 7zip does not react well to corrupt files. I usually unzip the thing and then rezip it with something else and continue to use 7zip.
Re: (Score:3)
Had multiple archives which were reporting as corrupt / damaged in 7zip and opened fine in WinRAR, near a decade ago.
I've used 7-Zip for years. Never had a problem, with RAR files (single or multi-part) or any other archive type. YMMV
Re: (Score:2)
The big reason is RAR introduced a new revision just a few years ago, called RAR5. It changed a lot of things and if your RAR decompressor didn't know how to handle RAR5, it would report the file as corrupt.
The solution as always is to update - 7zip doesn't have native RAR support, so you needed to update the unrar DLL or exe and all would be fine.
Even RAR users were caught - update WinRAR an
Wasn't it obvious? (Score:2)
...that there were some bugs in WinRAR when all of a sudden everybody starts getting .RAR file attachments from random people?
Why use an obscure compression program otherwise?
RAR (Score:2)
Who uses .RAR archives these days?
Re: (Score:3)
Who uses .RAR archives these days?
Sadly many more than you would think, I encounter them more often than zipped archives in several different fields I deal with. And my efforts to get the authors.developers to change to an application that uses a more open standard have not been very successful. The frequent response I get is "I don't want to learn a new program" or "it works so why should I change?".
Re: (Score:3, Informative)
They are very common indeed in the world of piracy. There was a time when RAR was the world leader in typical compression ratio, and pirates desperately needed the best compression around. Even though 7z is now superior in just about every way, RAR has become entrenched, and very hard to displace.
Re: (Score:1)
In the emulation/ROM scene, RAR is heavily used because of the frequent changes to ROM archives due to all the constant redumps, fixes and other improvements that keep being contributed by the community.
7-Zip is great if you're making an archive of content that will never change, but the 7-Zip format is a "solid" compression format, meaning that adding, changing and removing files requires you to decompress and recompress the *entire archive*.
RAR doesn't compress as heavily as 7-Zip, but it's a hell of a lo
Re: (Score:2)
Re: (Score:2)
Everyone. Is that the answer you were looking for? No seriously with multi-part compressed files RAR or self extracting RARs are still incredibly popular. The real question is who uses .ACE archives these days since that is what the article is actually about.
Not a surprise (Score:1)
Maybe just me, but all the contexts I ever saw WinRAR in convinced me that it was always sketchy AF. In any case I don't think I've seen it in 10 years.
He drank it (Score:2)
"It's ok. Just download it and unzip it and don't run it if it's .exe!"
His friend moused to the DL button. The other guy made a face like Richie's little brother waiting to see if Kirk would drink the tranya.
Blacklist the file and be done with it? (Score:1)
MD5 Checksum: 7FE66F3BD9CBB998D56EF60D511FF06F
SHA-1 Checksum: DFD7AF26DD22DFDE03B78E835AAAA1569737A6C3
SHA-256 Checksum: 219FF84A756E7912C84EC7BE3BEE5E29FB91909AAEF8856C3DDA2C4F
Re: (Score:2)
Next week on /.: "M$ Spyware Windows 10 has the ability to delete .dll files from your PC without your consent!" ;)
Nothing new (Score:1)
Re: (Score:2)
Pwned, yes. But don't worry, the only people who know the web sites and pages you visit are are the advertising giants of Google, Amazon, facebook. And Microsoft monitors you even if you use Chrome, and wants you eventually subscribe to Windows as a cloud thing so it can monitor you directly, and every government on the planet, shrimp salad, shrimp and potatoes, shrimp burger, shrimp sandwich. That's about it.