Imagine opening a file with Winrar, and it installs malware on your system. WinRAR is a widely used utility for compressing and decompressing data. But according to the latest information from THN , a flaw allows hackers to distribute malware. Israeli security researcher Danor Cohen (An7i) discovered that a feature allows forgery in the data the application compresses. Let's see how.
The hacker says that by modifying a file name and its extension within the traditional archive, he can hide binary malicious code within a file, pretending to be a .jpg, or .txt, or any other format.
Using a Hex editor, he analyzed a ZIP file and noticed that the application adds some custom properties to a file, which usually has two name references in the properties. The first name is the original file name (FAX.png) and the second name is again the file name (FAX.png). The file properties are displayed in the WinRAR GUI window.
Danor changed the second filename to FAX.EXE and the extension of the malicious FAX.EXE file to FAX.PNG. Then, it’s easy, he prepared a separate ZIP archive, which contained a malware file “FAX.exe”, but displayed it as “FAX.png” to the end user.
Security firm IntelCrawler also published a report, which reveals that cybercriminals are using this zero-day vulnerability to target aerospace companies, military contractors, embassies, and many other companies.
Using this technique, an attacker can install any malware in a very convincing manner on the systems they choose.
Danor managed to run the exploit successfully on version 4.20 of the application, but IntelCrawler confirmed that the vulnerability is compatible with all versions of the popular application including the latest V.5.1.
