Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-Zip: Multiple Memory Corruptions via RAR and ZIP

landave.io

Post reply on HN
Print view View original

101–106 of 106 posts

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#101

Post by tscs37 »

proactivesvcs wrote: post #53
freeflight wrote: post #50

Earlier quoted context omitted.

> The logs and alerts from blocked infection attempts are testament to this. Infection attempts by what? Scans of phishing mail attachments they wouldn't have opened anyway? At least if they know what they are doing. In addition, many AV have this annoying habit of reporting quite a bit of false-positives based on sys-calls or some weird heuristics, this leads to the situation where even totally legit software, from…

> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would ha…

I recommend to keep the microsoft scanner active (Windows Defender or how they call it by now).

It catches all the common stuff with high accuracy and only some of the exotic stuff gets through (which would probably be a pass for most other scanners too)

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#102

Post by Dylan16807 »

irundebian wrote: post #98
freeflight wrote: post #65

Earlier quoted context omitted.

> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding sta…

> If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. Don't blame the user, when we as computer scientists are too stupid to build secure systems. I expect from an computer system / software th…

If you want to protect the user from email attachments from strangers, block them all, don't base it on a scan that picks up some threats.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#103

Post by quotheth »

AnIdiotOnTheNet wrote: post #85
quotheth wrote: post #75

Earlier quoted context omitted.

I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.

These specific ones? Yeah, not that big a deal, but my post is about a development mindset, not the specific implementation. A few vulnerabilities show up in otherwise really great software and the idiots who browse this joint literally say the guy needs an intervention.

I don't get what you're arguing - this has nothing to do with the developer mindset. He just has to flip a compiler switch and vulnerabilities won't be trivially exploitable anymore.

It's totally irresponsible.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#104

Post by rurban »

chrisper wrote: post #38
withinrafael wrote: post #35

Earlier quoted context omitted.

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Is there a good alternative to 7-zip?

I also lost my trust into zlib recently, given that the current released version is full of bugs, and the current master is written horribly. Not as bad as openssl, but close. E.g. they are still using K&R sigs, wrong casts, and have several copy&paste bugs which you only detect with a stricter c++ compiler.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#106

Post by quotheth »

userbinator wrote: post #95
AnIdiotOnTheNet wrote: post #85

Earlier quoted context omitted.

These specific ones? Yeah, not that big a deal, but my post is about a development mindset, not the specific implementation. A few vulnerabilities show up in otherwise really great software and the idiots who browse this joint literally say the guy needs an intervention.

No kidding. The authoritarian security cargo-culting irritates me too. The fact that 7-zip bugs are rare enough that they make news when they are discovered already says a lot about the overall quality of the code. Many other projects with all the bloaty mitigations and other ostensibly "for security" cruft still manage to create severe bugs on a regular basis.

I read posts like this and it's just so clear to me why we're so fucked.
Post reply on HN