Slyck.com
 
Slyck Chatbox - And More

Nasty WinRAR bug is being actively exploited to install hard-to-detect malware

What's happening in the technology world related to software. Please submit stories for this forum here.
Forum rules
PLEASE READ BEFORE POSTING: Slyck Forum Rules

Nasty WinRAR bug is being actively exploited to install hard-to-detect malware

Postby MrFredPFL » Fri Mar 15, 2019 10:52 pm

Story : https://arstechnica.com/information-technology/2019/03/nasty-winrar-bug-is-being





Malicious hackers wasted no time exploiting a nasty code-execution vulnerability recently disclosed in WinRAR, a Windows file-compression program with 500 million users worldwide. The in-the-wild attacks install malware that, at the time this post was going live, was undetected by the vast majority of antivirus product.

The flaw, disclosed last month by Check Point Research, garnered instant mass attention because it made it possible for attackers to surreptitiously install persistent malicious applications when a target opened a compressed ZIP file using any version of WinRAR released over the past 19 years. The absolute path traversal made it possible for archive files to extract to the Windows startup folder (or any other folder of the archive creator’s choosing) without generating a warning. From there, malicious payloads would automatically be run the next time the computer rebooted.

On Thursday, a researcher at McAfee reported that the security firm identified “100 unique exploits and counting” in the first week since the vulnerability was disclosed. So far, most of the initial targets were located in the US.

“One recent example piggybacks on a bootlegged copy of Ariana Grande’s hit album Thank U, Next with a file name of ‘Ariana_Grande-thank_u,_next(2019)_[320].rar,’” McAfee Research Architect Craig Schmugar wrote in the post. “When a vulnerable version of WinRAR is used to extract the contents of this archive, a malicious payload is created in the Startup folder behind the scenes. User Access Control (UAC) is bypassed, so no alert is displayed to the user. The next time the system restarts, the malware is run.”







User avatar
MrFredPFL
 
Posts: 15648
Joined: Wed Aug 17, 2005 4:48 pm

Return to Tech/Software News

Who is online

Users browsing this forum: No registered users and 2 guests

© 2001-2008 Slyck.com