Skip Navigation

Cybersecurity @sh.itjust.works

Alphane Moon @lemmy.world

6d ago

WinRAR security flaw ignores Windows Mark of the Web security warnings

www.tomshardware.com

WinRAR security flaw ignores Windows Mark of the Web security warnings

20 comments

7z is far superior. It's does rar
STOP USING WINRAR PEOPLE
- I like the interface of WinRAR more (just a matter of habit).
  I even have a license for WinRAR that I bought 15 years ago.
  
  good on you, for buying a copy.
- People is stuck on winrar by nostalgia
  
  I would miss having decide whether to buy it every time I open it.

What the hell is a "Mark of the Web"?
- Notification/warning that an executable was downloaded from the internet.
  
  Protip: All things are downloaded from the Internet.
- It's something called ADS (Alternate Data Stream) which you can see as some kind of second hidden file content. Browsers create an ADS with name Zone.Identifier when downloading a file and attach it to the downloaded file. The content of the ADS is the information where the file was downloaded from, i.e. the Zone (3 for Internet) and usually the URL.
  Programs and Windows usually use the existence of the Zone.Identifier to show you a warning that a file was downloaded and may pose a risk to your system when opening/exexuting it.
  
  What the fuck is this arcane metadata bullshit?
  I download a file on Linux, and it has data, a filename, and some permission metadata. That's it. It sounds like this metadata layer deserves all of the hacks that will come for it.

I once got a really nasty cryptominer that shut down all attempt to remove it via a fully patched WinRar opening an archive with what seemed to mostly JPEGs (maybe some PDFs as well). Perhaps this vulnerablility the root enabler of the cryptominer.

oh WinRAR, the freest paid app in history

20 comments