Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-Zip: Multiple Memory Corruptions via RAR and ZIP

landave.io

Post reply on HN
Print view View original

71–80 of 106 posts

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#71

Post by hutzlibu »

marshray wrote: post #67
freeflight wrote: post #65

Earlier quoted context omitted.

> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding sta…

> nobody, with the appropriate training, should be opening them in the first place How many users do you administer again?

I guess that doesn't matter as he said "should".

But yeah, reality is different ...

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#72

Post by woodson »

landave wrote: post #5
carussell wrote: post #3

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore v…

You are completely right with the first comment. The antivirus product itself reuses parts of 7-Zip and is vulnerable itself. I mentioned this mainly because I did not analyze the original 7-Zip software, but only discovered that it was affected as well after I had found the bug in this antivirus product. I admit that this is confusing, so I'll probably try to rephrase this.

Seems like a possible license violation then (7-Zip is LGPL).

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#73

Post by arca_vorago »

proactivesvcs wrote: post #55
pixl97 wrote: post #49

Earlier quoted context omitted.

Your experience seems very limited. Be a MSP with thousands or tens of thousands of different configurations, all the different antivirus software you can think of, and 20+ years of doing it and you'll see anti-virus break everything you can think of. AV prevents windows from shutting down. AV prevents windows from booting up. AV prevents windows upgrades. AV prevents windows updates. AV causes blue screens. AV quara…

I'd suggest you don't know what experience I have. I've certainly had problems with anti-virus programs, but no more than I have had with any program, operating system, driver or hardware problem really. Mostly they behave, sometimes they misbehave. I've rarely seen anti-virus causing shutdown problems. Boot problems have almost always been faulty storage devices or operating system corruption. I've fixed more faulty…

Are you saying av isn't widely crap? Because as a senior sysadmin I agree with gp very much. I don't understand why you are defending av at all honestly. It is one of the crappiest software industries in existence!

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#74

Post by dogma1138 »

Ajedi32 wrote: post #64
vocatus_gate wrote: post #40

Earlier quoted context omitted.

Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.

Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.

Since they get theirs from an insecure source it really isnt.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#75

Post by quotheth »

AnIdiotOnTheNet wrote: post #52
withinrafael wrote: post #35

Earlier quoted context omitted.

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is…

I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#76

Post by quotheth »

landave wrote: post #69
mjevans wrote: post #68

Earlier quoted context omitted.

It would be interesting to have a comparison based on locally built binaries both with and without these features enabled. Performing the tests on packing the actual 7-Zip source code (as shipped without extras) would be a valid reference suite.

I assume you mean a performance comparison? The runtime performance cost of ASLR on Windows is zero once a binary has been loaded, since the code is relocated at load time. Stack canaries might cause a slight performance hit, but it is usually below one percent, since it creates only a small cost per function call for a fraction of all functions.

It isn't even per function call in all implementations.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#77

Post by brokenmachine »

landave wrote: post #46
Froyoh wrote: post #33

Where do you learn about these things? This all went over my head.

What do you mean exactly by "these things"? It may be that the blog post is difficult to understand simply because I have written it poorly...

I read posts like that and marvel at how much people can understand. Well done and thanks for posting.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#78

Post by alibert »

katastic wrote: post #13
blattimwind wrote: post #8

Earlier quoted context omitted.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…

I also believed this for a long time but recently I stumbled upon this https://www.malwarebytes.com/remediationmap/

Obviously this is an anti malware company PR (but please look at the MS Consumer (defender) failed detection rate). This made me research again the AV landscape and then I found this https://fatsecurity.com/tools/test-results-calculator?compan... A website that seems to aggregate a lot of AV independent tests in an easy to use UI.

MS Defender is not really good now. Even free AV are better and have lesser performance impact than Defender (but obviously come with ads, less privacy, etc.).

(I submitted recently the map to start a discussion about it but did not seem to interest anyone)

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#79

Post by rootw0rm »

leeter wrote: post #37
withinrafael wrote: post #35

Earlier quoted context omitted.

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.

Agreed.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#80

Post by rootw0rm »

alibert wrote: post #78
katastic wrote: post #13

Earlier quoted context omitted.

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…

I also believed this for a long time but recently I stumbled upon this https://www.malwarebytes.com/remediationmap/ Obviously this is an anti malware company PR (but please look at the MS Consumer (defender) failed detection rate). This made me research again the AV landscape and then I found this https://fatsecurity.com/tools/test-results-calculator?compan... A website that seems to aggregate a lot of AV independent…

AV sucks, Defender sucks more, brain behind the keyboard is king.
Post reply on HN