Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7zip.com Is Serving Malware

malwarebytes.com

Post reply on HN
Print view View original

41–50 of 104 posts

Re: 7zip.com Is Serving Malware

#41

Post by imglorp »

pibaker wrote: post #15
Dwedit wrote: post #6

7zip.com has never been the official website of the project. It's been 7-zip.org

How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?

Open source software will have a code repo with active development happening on it. That repo will usually link to official Web page and download places.

Re: 7zip.com Is Serving Malware

#42

Post by jamespo »

throwaway198846 wrote: post #35
n4bz0r wrote: post #29

Earlier quoted context omitted.

There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.

So wikipedia is now part of the supply chain (informally) which means there is another set of people who will try to hijack Wikipedia, as if we didn't had enough, just great.

What's your solution? If you search google for 7-zip the official website is the first hit.

Re: 7zip.com Is Serving Malware

#43

Post by lyu07282 »

throwaway198846 wrote: post #35
n4bz0r wrote: post #29

Earlier quoted context omitted.

There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.

So wikipedia is now part of the supply chain (informally) which means there is another set of people who will try to hijack Wikipedia, as if we didn't had enough, just great.

I was always impressed by how fast wikipedia editors revert that kind of stuff, so I think it's great advice actually!

Re: 7zip.com Is Serving Malware

#44

Post by harladsinsteden »

pibaker wrote: post #15
Dwedit wrote: post #6

7zip.com has never been the official website of the project. It's been 7-zip.org

How can the average 7zip user know which one it is? Search results can be gamed by SEO, there were also cases of malware developers buying ads so links to the malware download show up above legitimate ones. Wikipedia works only for projects prominent enough to have a Wikipedia page. What are the other mechanisms for finding out the official website of a software?

How would you ensure that the "average user" actually gets to the page he expects to get to?

There are risks in everything you do. If the average user doesn't know where the application he wants to download _actually_ comes from then maybe the average user shouldn't use the internet at all?

Re: 7zip.com Is Serving Malware

#46

Post by chalion »

throwaway150 wrote: post #23

I tested with the 3 major browsers and all 3 block it as "Suspected Phishing". So looks like the system is working as designed. Lookalike websites serving malware have always existed. So this isn't exactly news. But the browsers are blocking them like they should.

Weirdly, in Firefox 7zip.com is blocked but www.7zip.com isn't. If you type '7zip' in the address bar and then press Ctrl+Enter to go to the address, you'll get owned, because that key-combo adds the www at the beginning.

Re: 7zip.com Is Serving Malware

#47

Post by chalion »

krypd0h wrote: post #45

The links to the file downloads on 7zip.com all point to 7-zip.org. Example: https://www.7-zip.org/a/7z2501-x64.exe Did they change it because of the negative publicity (Reddit) and will probably change back soon to the malware links?

Maybe that's how they don't get banned by their hosting provider. Once reports start coming in, they pretend to be a honest establishment.

Re: 7zip.com Is Serving Malware

#48

Post by Already__Taken »

reddalo wrote: post #16
tokyobreakfast wrote: post #5

Does the 7-Zip author still refuse to digitally sign or even provide hashes of the official downloads? It's an extremely weird flex, he thinks it's a frivolous waste of time or something.

I migrated from 7-Zip to NanaZip, a fork with modern Windows features that the original developer refuses to implement. https://github.com/M2Team/NanaZip

No update for a year for something that opens weird files from the internet is a little scary, even just dependency changes. Not that 7-zip was ever any better at that.

Re: 7zip.com Is Serving Malware

#49

Post by n4bz0r »

throwaway198846 wrote: post #35
n4bz0r wrote: post #29

Earlier quoted context omitted.

There is normally a wiki page for every popular program which normally contains an official site URL. That's how I remember where to actually get PuTTY. Wiki can potentially be abused if it's a lesser known software, but, in general, it's a good indicator of legitimacy.

So wikipedia is now part of the supply chain (informally) which means there is another set of people who will try to hijack Wikipedia, as if we didn't had enough, just great.

Not exactly news, wiki's been used for misinformation quite extensively from what I recall. You can't always be 100% sure with any online source of information, but at least you know there is an extensive community that'll notice if something's fishy rather sooner than later.
Post reply on HN