Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple 7-Zip Vulnerabilities Discovered

blog.talosintel.com

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Multiple 7-Zip Vulnerabilities Discovered

#31

Post by paulfr »

JetSetWilly wrote: post #30
striking wrote: post #24

Earlier quoted context omitted.

You can be appalled, but it's not like anyone's paying them for the work that they do. If you want to help them, I'm sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it's funny that you're so shocked that a popular free software project isn't perfect. Be the change you want to see. PS: who cares if the devs are using unsigned software d…

Every time an open source project is criticised, you get people saying "why are you criticising, you should do the work" - to the point that this seems to be a mechanism to shutdown any and all criticism of any open source project via special pleading. One can be very grateful for the work done on an open source project, and recognise that I have no right whatsoever to expect them to hop to it, but I am always free t…

Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to have an objective look at the current shortcomings in the state of 7-zip security, both in order to understand what needs to be done to fix it, and in order to warn current users until those issues are fixed.

7-zip is a widely popular basic utility, like a web browser. A flaw in 7-zip is very serious, because as I pointed out elsewhere simply opening a .zip file will allow an attacker to exploit it. And while there is a strong security culture among web browser developers, 7-zip doesn't seem to have that culture (yet).

There is certainly a massive budget and manpower difference, but a lack of mention of security fixes in the changelog and a lack of hashes isn't a manpower issue, it's a culture issue.

As a side note, compromise of a developer's machine is a big deal in my opinion: it could be easy for a criminal entity to slip in a tiny change in a large patch that introduces a vulnerability; and depending on how builds are performed, a criminal could patch the final .exe with no visible change to the source code. These are tailored attacks, but for a very widely distributed program it would easily be worth the criminal's time.

Re: Multiple 7-Zip Vulnerabilities Discovered

#32

Post by [deleted] »

valarauca1 wrote: post #27
arkitaip wrote: post #14

Earlier quoted context omitted.

Not really sure why you would need regular releases for handing zip files, though.

Windows handles zip files horribly. The time to extract a 100MB zip in windows explorer is 4-6minutes (if not more). Compare this to ~30seconds in 7zip.

[deleted]

Re: Multiple 7-Zip Vulnerabilities Discovered

#33

Post by paulfr »

colejohnson66 wrote: post #23
paulfr wrote: post #17

Earlier quoted context omitted.

I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface. EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file ex…

IIRC, 7-zip does tell you if the actual format is different. At least it does when I extract some DMGs; it tells me it's actually an HFS "file".

Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.

Re: Multiple 7-Zip Vulnerabilities Discovered

#34

Post by realkitkat »

paulfr wrote: post #15

I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it…

7-zips track record of lack of vulnerabilities [1] would imply something entirely different to me. Only 2 CVEs ( and now this ) in a heck of a long time. 7z being used in quite a variety of places it seems like a lucrative attack vector, so I would expect that ample amount of fuzzing and other techniques has gone into trying to break it over the years. Which obviously doesn't mean, as these findings highlight, that it would be in any way infallible either. But to say they don't take security seriously sounds little unfair to me.

[1] https://www.cvedetails.com/vulnerability-list/vendor_id-9220...

Re: Multiple 7-Zip Vulnerabilities Discovered

#35

Post by striking »

JetSetWilly wrote: post #30
striking wrote: post #24

Earlier quoted context omitted.

You can be appalled, but it's not like anyone's paying them for the work that they do. If you want to help them, I'm sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it's funny that you're so shocked that a popular free software project isn't perfect. Be the change you want to see. PS: who cares if the devs are using unsigned software d…

Every time an open source project is criticised, you get people saying "why are you criticising, you should do the work" - to the point that this seems to be a mechanism to shutdown any and all criticism of any open source project via special pleading. One can be very grateful for the work done on an open source project, and recognise that I have no right whatsoever to expect them to hop to it, but I am always free t…

Anyone's within their right to criticize an open source project. I think being "appalled" is a tad illogical, though.

Similarly, does complaining about it on a public forum have any effect? In my book, code speaks louder than words; if you really want to see change, you know what to do.

Re: Multiple 7-Zip Vulnerabilities Discovered

#36

Post by eslaught »

striking wrote: post #24
paulfr wrote: post #15

I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it…

You can be appalled, but it's not like anyone's paying them for the work that they do. If you want to help them, I'm sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it's funny that you're so shocked that a popular free software project isn't perfect. Be the change you want to see. PS: who cares if the devs are using unsigned software d…

> PS: who cares if the devs are using unsigned software downloaded over HTTP? I care about using signed software (and then I suppose the transport doesn't really matter), but that's totally unrelated to what the devs do on their own computers.

This is definitely a vector that attackers can and do use. If the developer is infected, particularly by a virus that changes the compiler to emit infected code, this can by proxy infect the products they develop.

See e.g.:

https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

Re: Multiple 7-Zip Vulnerabilities Discovered

#38

Post by de47 »

striking wrote: post #35
JetSetWilly wrote: post #30

Earlier quoted context omitted.

Every time an open source project is criticised, you get people saying "why are you criticising, you should do the work" - to the point that this seems to be a mechanism to shutdown any and all criticism of any open source project via special pleading. One can be very grateful for the work done on an open source project, and recognise that I have no right whatsoever to expect them to hop to it, but I am always free t…

Anyone's within their right to criticize an open source project. I think being "appalled" is a tad illogical, though. Similarly, does complaining about it on a public forum have any effect? In my book, code speaks louder than words; if you really want to see change, you know what to do.

Being appalled seems right to me.

Under many circumstances, our actions come with a certain degree of responsibility. When we write code, we have the responsibility to be pretty open about security.

Re: Multiple 7-Zip Vulnerabilities Discovered

#40

Post by striking »

paulfr wrote: post #31
JetSetWilly wrote: post #30

Earlier quoted context omitted.

Every time an open source project is criticised, you get people saying "why are you criticising, you should do the work" - to the point that this seems to be a mechanism to shutdown any and all criticism of any open source project via special pleading. One can be very grateful for the work done on an open source project, and recognise that I have no right whatsoever to expect them to hop to it, but I am always free t…

Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to have an objective look at the current shortcomings in the state of 7-zip security, both in order to understand what needs to be done to fix it, and in order to warn current users until those issues are fixed. 7-zip is a widely popular basic…

I'm glad you care so much, but I don't think you can fix a culture issue by explaining it away. The best way to set a culture where there hasn't been one before, is to lead by example.

Re: side note; the vulnerability described in the well-known Ken Thompson paper has been exploited just once in the wild. It's cool, but you could say the same thing about trusting Windows or proprietary drivers or hardware.

Post reply on HN