Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-Zip: Multiple Memory Corruptions via RAR and ZIP

landave.io

Post reply on HN
Print view View original

61–70 of 106 posts

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#61

Post by Nadya »

katastic wrote: post #13
blattimwind wrote: post #8

Earlier quoted context omitted.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…

I'm also one of those people.

When it runs code to detect if it is a virus, you have to trust the sandboxing and frankly I've yet to see a sandbox that at some point hasn't been taken control of and exploited (this goes for web browsers too). So it's better to just not execute code than to trust the AV's VM to execute the code without being compromised.

I use programs on a whitelist basis and only update for security patches. This avoids issues like what happened with Transmission.

AV also detect have pitiful detection rates - something like E: I imagine the downvotes are from my claims of pitiful detection rates or claims that AV is basically security fanfare. Don't take my word for it then.

[0] https://www.theguardian.com/technology/2014/may/06/antivirus...

[1] http://www.blackhat.com/presentations/bh-europe-08/Feng-Xue/...

[2] http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-whe...

[3] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1916708

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#62

Post by hutzlibu »

Hello71 wrote: post #51
proactivesvcs wrote: post #42

Earlier quoted context omitted.

Many of my customers run the common free anti-virus programs and I can assure you that they are not snake oil. The logs and alerts from blocked infection attempts are testament to this. I certainly would say that most of the free anti-virus is pushy, hungry and generally not a particularly great marketing exercise.

https://en.wikipedia.org/wiki/List_of_rogue_security_softwar...

No no, it was original antivirus. But it's been a while(I got hesitant doing maintenance), so I can't tell for sure which ones.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#63

Post by blub »

AnIdiotOnTheNet wrote: post #52
withinrafael wrote: post #35

Earlier quoted context omitted.

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is…

Using HTTPS for downloads and signing binaries won't magically make software slower.

It's the security equivalent of washing one's hands after using the toilet...

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#64

Post by Ajedi32 »

vocatus_gate wrote: post #40
withinrafael wrote: post #35

Earlier quoted context omitted.

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.

Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#65

Post by freeflight »

proactivesvcs wrote: post #53
freeflight wrote: post #50

Earlier quoted context omitted.

> The logs and alerts from blocked infection attempts are testament to this. Infection attempts by what? Scans of phishing mail attachments they wouldn't have opened anyway? At least if they know what they are doing. In addition, many AV have this annoying habit of reporting quite a bit of false-positives based on sys-calls or some weird heuristics, this leads to the situation where even totally legit software, from…

> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would ha…

> They were not legitimate software from trusted sources.

Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place.

Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding stats but is it a real security gain?

Afaik by now one of the most common successful attack vectors is drive-by kits [0], increasingly served trough advertisement channels. Ad-blockers/disabling Java minimize this risk quite a bit, with low overhead, while having the added comfort of making the web more user-friendly.

Which to me is the most sensible solution, unless one really likes opening weird email attachments and/or plugging in untrusted devices.

> I don't think that in any of the cases the user would have had a warning to blindly click through.

If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place.

[0] http://www.securityweek.com/internets-big-threat-drive-attac...

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#66

Post by landave »

So I just tried to compile 7-Zip with VS2017 and /DYNAMICBASE. The main binary 7z.dll is 1,569,792 bytes in total, 9344 bytes (0.595%) of which are used by the relocation table. Enabling stack canaries (/GS) gives me a 1,578,496 byte binary (including the relocation table), so another 8704 bytes more.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#67

Post by marshray »

freeflight wrote: post #65
proactivesvcs wrote: post #53

Earlier quoted context omitted.

> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would ha…

> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding sta…

> nobody, with the appropriate training, should be opening them in the first place

How many users do you administer again?

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#68

Post by mjevans »

landave wrote: post #66

So I just tried to compile 7-Zip with VS2017 and /DYNAMICBASE. The main binary 7z.dll is 1,569,792 bytes in total, 9344 bytes (0.595%) of which are used by the relocation table. Enabling stack canaries (/GS) gives me a 1,578,496 byte binary (including the relocation table), so another 8704 bytes more.

It would be interesting to have a comparison based on locally built binaries both with and without these features enabled.

Performing the tests on packing the actual 7-Zip source code (as shipped without extras) would be a valid reference suite.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#69

Post by landave »

mjevans wrote: post #68
landave wrote: post #66

So I just tried to compile 7-Zip with VS2017 and /DYNAMICBASE. The main binary 7z.dll is 1,569,792 bytes in total, 9344 bytes (0.595%) of which are used by the relocation table. Enabling stack canaries (/GS) gives me a 1,578,496 byte binary (including the relocation table), so another 8704 bytes more.

It would be interesting to have a comparison based on locally built binaries both with and without these features enabled. Performing the tests on packing the actual 7-Zip source code (as shipped without extras) would be a valid reference suite.

I assume you mean a performance comparison? The runtime performance cost of ASLR on Windows is zero once a binary has been loaded, since the code is relocated at load time.

Stack canaries might cause a slight performance hit, but it is usually below one percent, since it creates only a small cost per function call for a fraction of all functions.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#70

Post by hutzlibu »

freeflight wrote: post #50
proactivesvcs wrote: post #42

Earlier quoted context omitted.

Many of my customers run the common free anti-virus programs and I can assure you that they are not snake oil. The logs and alerts from blocked infection attempts are testament to this. I certainly would say that most of the free anti-virus is pushy, hungry and generally not a particularly great marketing exercise.

> The logs and alerts from blocked infection attempts are testament to this. Infection attempts by what? Scans of phishing mail attachments they wouldn't have opened anyway? At least if they know what they are doing. In addition, many AV have this annoying habit of reporting quite a bit of false-positives based on sys-calls or some weird heuristics, this leads to the situation where even totally legit software, from…

"Which then conditions people to just click past the warning, at that point you might as well not even run the AV at all"

anectode: a girl in my student flat wanted to give me some file and copied it to her usb-stick. But as she plugged her stick in, a antivirus warning popped up and said very clearly INFECTION DETECTED. But she just clicked it away and said it does that all the time since weeks ...

Wait what?!?

And she was a student (for high school teacher), so supposed to be not stupid. But in this case the antivirus was actually one of the better once which mostly only said something if there was something. But to her it had the same meaning as "update me please". Not something to be bothered with her now, as her task was to copy something to the USB stick ...

So yes, definitely also bad conditioned, but also plain stupid. Or overburdened.

So for those people, antivirus (wheter from the os or third party) which really blocks stupid things and scans everything, make sense. And there are a lot of those people ... in my example it was someone who grew up with computers, but there are still many around who had to learn it much later in life. And they just click onto everything.

Post reply on HN