Earlier quoted context omitted.
Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.
It's open source; feel free to fork.
"Secure 7-Zip" even sounds like a good name.
7-Zip: Multiple Memory Corruptions via RAR and ZIP
91–100 of 106 posts
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#92Earlier quoted context omitted.
Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.
Yeah, that's pretty terrible. Seems like the only secure way to get a copy of 7-zip is to install it via Chocolatey or Sourceforge.
No, you can get them from the official Sourceforge project over HTTPS: https://sourceforge.net/projects/sevenzip/
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#93Earlier quoted context omitted.
I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.
These specific ones? Yeah, not that big a deal, but my post is about a development mindset, not the specific implementation. A few vulnerabilities show up in otherwise really great software and the idiots who browse this joint literally say the guy needs an intervention.
Well, HTTPS and high-confidence builds are popular concepts here, given that this forum is frequented by people on both side of the security fence.
At least I would assume it is. There are lots of white-hat reports, so...
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#94Earlier quoted context omitted.
> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding sta…
> nobody, with the appropriate training, should be opening them in the first place How many users do you administer again?
A whole lot of 5 users, I realize that in bigger companies it's probably less hassle to just install AV software and "hardblock" undesired behavior.
I imagine that depending on the country you are operating in this might even be a requirement to prevent legal hassle, getting sued for "neglect" if not running AV software and something actually goes wrong but IANAL.
But let's also keep in mind that AV solutions can have the exact opposite effect of what they're supposed to do, from data leakage [0] [1] to straight up remote code executions [2]. Which isn't that surprising, considering that more complexity is usually a bad thing to add to any system, especially if it's as deep-rooted as most AV suits tend to be.
[0] https://www.directdefense.com/harvesting-cb-response-data-le...
[1] https://www.siliconrepublic.com/enterprise/kaspersky-nsa-lea...
[2] https://landave.io/2017/06/avast-antivirus-remote-stack-buff...
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#95Earlier quoted context omitted.
I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.
These specific ones? Yeah, not that big a deal, but my post is about a development mindset, not the specific implementation. A few vulnerabilities show up in otherwise really great software and the idiots who browse this joint literally say the guy needs an intervention.
No kidding. The authoritarian security cargo-culting irritates me too.
The fact that 7-zip bugs are rare enough that they make news when they are discovered already says a lot about the overall quality of the code. Many other projects with all the bloaty mitigations and other ostensibly "for security" cruft still manage to create severe bugs on a regular basis.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#96Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#97Earlier quoted context omitted.
Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.
It's open source; feel free to fork.
sigh already downloaded the source, trying to convince myself I need to do this. The code is pretty much pure C++98 along with all the pain that comes with that.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#98Earlier quoted context omitted.
> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would ha…
> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding sta…
> If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place.
Don't blame the user, when we as computer scientists are too stupid to build secure systems. I expect from an computer system / software that I don't get infected if I plug in a USB stick or open a PDF file. The software devs of operatings systems and applications as well as hardware vendors are to blame. That's it.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#99Earlier quoted context omitted.
Yeah, anti-virus is a crap idea. Real security is proactive security (exploit mitigation, sandboxing, correct code, safe languages). Reactive security kinda sucks. You have to patch known vulnerabilities , sure, but detecting exploits? Ugh. Eww. Do not like. And indeed users mostly install malware these days, because self spreading (actual "viruses") is hard (we're not in the DOS/Win9x days anymore). So users should…
This is really just not accurate. You can say that AVs are crap, but please don't put all of your eggs in the 'proactive security' basket. At one point that was actually the prevailing attitude, and it just failed absolutely miserably. Instead, today, we see more companies invest in what's called "incident response". Part of a healthy incidence response program is signature detection - AV plays a role in this. If you…
Of course you should be able to respond on security incidents. If you have a security incidents it's often too late and security boundaries are already borken. In the long term we want to have secure systems which are secure by design and by default.
We have to invest heavily in incident response because we have have all of these shitty and broken systems. We should already have started heavily on building secure systems and secure languages and should call on everybody to invest time to build these instead of building reactive technologies like AV.