This File Archiver was PWNed

[00:00:00]Hello everybody, my name is Eric, and today we're going to be talking about a new vulnerability that's been uncovered in 7-Zip. Uh so 7-Zip has patched what they're calling a code smuggling or remote execution uh vulnerability.

[00:00:14]It's bad, okay? And it can be in some ways a bit worse because 7-Zip doesn't have an auto updater, which I guess as we saw with Notepad++ can be a problem on its own, but right, this is on this VM I have 7-Zip installed, and it is version 20.01.

[00:00:29]If you Or it says that you need to update. Uh so I have So of course we can go here to 7-Zip. I'll show you how to do that in just a minute. We'll take a look at this first. So the most popular archive utility has had a security vulnerability that could allow executing code. Uh this would happen if you opened an archive with 7-Zip, and the maliciously crafted file was designed uh it could remote like website. Okay, I'm going to check that, but so that's not good. Okay, so from editing I can confirm I looked into this. I think this is just misreporting. There is no plausible path to a website visit without downloading and clicking to getting a file processed by 7-Zip, which would be the prerequisite to trigger the remote code execution. So it would require you downloading an archive and opening it in 7-Zip. Uh this was reported in Trend Micro Zero Day Initiative uh that attackers can execute code in the context of the 7-Zip process, which is very bad. That is a way I We've seen this before, I think, on a WinRAR vulnerability, where we were testing a file, and it just instantly exploited.

[00:01:40]And 7-Zip is also in Winget, so that could be another way of updating it. So here we can see the CVE. Uh it doesn't seem to be on the official site. Let's see if that's changed. No, it hasn't. So it's been reserved, but the official CV hasn't been published, but it has now been reported. So, this vulnerability allows remote attackers to execute arbitrary code on affected installations. User interaction, uh so malicious page as well. I don't I don't like that. Or open a malicious file.

[00:02:11]So, the XE data, interestingly, this is the same format that about a year ago was backdoored on Linux, but not related. Uh so, when this data is uh crafted a certain way, it can trigger a heap overflow, which ultimately can get all the way to remote code execution, which is the scariest type of vulnerability. So, if you download an XE archive, maybe for example, you're like me and you're doing malware analysis, and you got an email saying that you knew was a phishing email, let's say, and you think, "Okay, I'm going to check this zip to see what's in here."

[00:02:48]You could get pwned while you're trying to research it. Or if you're a genuine victim, cuz there are a lot of emails, they come and it'll be something like this.

[00:02:57]You get something that says, for example, "Invoice for" I'm not making this up. I actually got this one.

[00:03:04]"Invoice for oilrig.dat." It's usually.dat, but we can say it's.exe cuz it doesn't matter, cuz Windows now supports that. Uh and inside would just be some sketchy.exe.

[00:03:15]But with this, they could make it so that if you even opened that with 7-Zip, and maybe they'd provide you an instruction to open it with 7-Zip, or just say but it has to be 7-Zip for some some zone reason, and then they've got you. Cuz 7-Zip is a widely used utility, and it's a good utility. It's not an attack on 7-Zip. So, what do you do?

[00:03:33]Well, the first thing you should do, right?

[00:03:36]No. No, we don't want Copilot.

[00:03:39]Uh first thing we should do is we go to 7-zip.org, not.com, it's.org. This website, I'll have in the description.

[00:03:46]Uh we go here.

[00:03:47]And this update has been out for a few weeks. So, if you were diligently updating, uh you'd be okay, but I don't think many people would be cuz there isn't an auto updater. Uh we go here.

[00:03:57]Let me go here.

[00:03:59]It's also kind of a fun way to demonstrate uh not this video is sponsored, but just uh I do have Threatlocker on this VM, and yep, the update does work. I didn't have to do anything. That's cool. And now we have the new version, and everything appears to be the same. We can go see the change log. Uh so, some bugs and vulnerabilities were fixed, and that's the standard for updates is you never say the moment you fix it what the bug was cuz then it still is still technically a zero-day pretty much the day that the patch came out, and then later it's disclosed so that people have time to update, and at some point the risk shifts, and it's actually riskier not to tell people to update because threat actors do know about this. And of course, especially on open-source software, but even on closed you can do this with binary analysis. You can look at the changes in the code, and and if you're skilled at exploit dev, I'm not really just to be honest. Uh you will go and you'll see, okay, especially if on release you see a mention, they'll go check the diffs, and they'll be like, okay, uh and of course, it's easier now that we know what the problem is cuz I can go, okay, uh exec here you go, and probably uh looking at the fact there's a s- new check added, and destling two is here.

[00:05:20]It's definitely something around here that was problematic.

[00:05:24]And nowadays, what some uh actors would also be doing, and I think does weaken delayed reporting, especially on open-source software, is they might just go to an AI model.

[00:05:38]I'll just try this out out of curiosity.

[00:05:42]I've no idea if this is going to yield results or not. Now, at this point I noticed something bizarre with my ChatGPT account. So, instead of using that, we're going to try Claude and also the new open source model from Kimmy because we all know Claude believes that anyone trying to do cybersecurity is just a criminal and should be refused an answer. So, we'll see if the open source model is more willing to talk.

[00:06:10]Now, I got the sense from reading the thinking summary here that I'm kind of being gaslit a bit. So, let's see. I I did just want to also try Kimmy.

[00:06:21]Because the Chinese models, unlike the American models, don't have all of the so-called safety classifiers, which, as many people pointed out, are equally good at stopping defensive people. But, in this case, maybe maybe not telling me exactly what vulnerability was fixed was the right call, but it does It's hard to tell. Does it not know, or is it lying to you?

[00:06:42]I I don't like it. I get it, but I don't like it.

[00:06:46]And it does ultimately internal search, but from reading the transparent caught uh I'm going to call that the correct answer. So, good to see that someone is being honest here.

[00:06:58]I do just want to give this just cuz I I was curious. I do just want to do this without web search enabled cuz I I just want to see uh can it figure it out? But, it is interesting to see that it went right for the same thing I noticed.

[00:07:15]And I think it it did it without being prompted because it did that first round and afterwards. So, I think that does kind of have an effect. Certainly not the mythological vulnerability apocalypse, but it does seem like it could be an uplift once the vulnerability is in the partially known stage. So, what can you do to protect yourself? Well, the big thing, always and this is the same as it's always been.

[00:07:43]Keep your software up to date.

[00:07:45]Use containerization and isolation. I think that's like if I had to give one tip that in the modern supply chain vulnerability world may have become even more important.

[00:07:55]And of course you still got to keep your hypervisor up to date. But using being a heavy user of virtual machines like for example this 7-Zip is running in a virtual machine. So hypothetically if I did fall for this and I hadn't updated this and I also did not have uh ThreatLocker which has uh also kind of containerized 7-Zip. If all of those were not true, the virtual machine would still prevent a total compromise.

[00:08:22]So I think that is a good way uh to deal as for as much especially if you're doing like malware work or touching anything untrusted, just keeping that totally containerized is a good idea.

[00:08:36]Sometimes I mean look using cloud services to check things not a bad idea cuz that stops it from being your problem.

[00:08:43]You know, there's kind of like a almost a midwit meme here where when you don't really know anything about computers you think okay anything untrusted is scary like can downloading something pwn me? Can this pwn me? Can this pwn me?

[00:08:58]And then when you know a bit you're like no no if you don't execute anything it's fine. And then you reach the point where you're like but vulnerabilities yes if nothing goes wrong that's correct but there's so many vulnerabilities that the safest thing to do is just not to execute untrusted things. And if you are looking at untrusted things you want to put layers of protection. An antivirus is one.

[00:09:22]Virtual machines is a really powerful one. Containers especially on Linux stuff like Docker powerful controlling privileges of applications powerful. So that's really going to be the key recommendation here. There's no There is no one click magical fix and everything button, sadly.

[00:09:40]I'm just looking at the code to see what's available here.

[00:09:44]Okay, so here's what I was looking for.

[00:09:46]Yes, so the answer is yes. It can with no additional cheating from the internet or from me.

[00:09:56]Uh Let me go back up to the top so I can show you what I did.

[00:10:01]What is this diff for? For what vulnerabilities are potentially being fixed? So, we can see no cheating.

[00:10:07]I don't have memory on open readers is not getting in that way.

[00:10:10]It finds a bunch of stuff. Uh Not sure if these other ones are valid.

[00:10:16]It doesn't look It doesn't look wrong, but it It also doesn't have the whole code base. It has the piece that's being changed. So, it might not fully There might be something else protecting those, but it seems like this patch was a bunch of memory safety improvements and one that was exploitable here.

[00:10:37]So, when decoding, the capacity was the destination size, which was not reduced by bytes already written. So, it could have been decoded past the end of the buffer, which could lead to a vulnerability.

[00:10:54]Curious how far this is going to go.

[00:10:56]So, be careful. It does seem like, you know, I think I think running your updates, that's important. Browsers especially cuz they can be one of the easiest to steal.

[00:11:07]Keeping your software up to date.

[00:11:10]Not much more to say. I mean, 7-Zip is perfectly fine and it could could happen to anyone. So, that is going to be all from me for now. Please let me know what you think about this video and this situation in the comments below. Bye.

[00:11:40]>> Mhm.