Slashdot Mirror
New Virus Attacks Via RAR Files
sscottsci writes "A new article at eWeek indicates that Virus writers are using .RAR files to bypass Filters and Anti-Virus systems to infect computers. Most anti-virus software cannot scan a .RAR file, and most firewalls do not block the extension yet."
Goatse once came to me in a .REAR file. Close enough to avoid.
Table-ized A.I.
don't accept rar files from people you don't know. And, if you do, don't run random executables inside them?
Le français vous intéresse?
Rar files are most commonly used in the legal archiving of binary files and DVDs.
"Warez is becoming infected with viruses!"
... in related news eWeek is able to sell more impressions and generate more revenue by getting coverage on Slashdot for pointless non-news articles such as new Virus hides in compressed files ...
A new virus is spreading through password-protected .arj files.
.ARJ file is, let alone find a password cracker for it.
Fortunatelly, no one got it, as no one remembers anymore what the heck an
Rumors said the password is "G04TSE.CXR0X".. go now then, have some fun...
how long until
It seems to me this would be the simplest. Just require the virus makers to use the .virus extension and that will give the AV makers more time to perfect RAR scanning.
Is anyone with me?
Boredom's not a burden anyone should bear.
someone shouted HQX at me once and I didn't sleep for a week.
If anything, we should congratulate them. They've found a way to cut down on a few bytes of junk data flying around the net.
:)
Cumulatively, it could be a big waste reduction.
Gosh. .
All my household systems come with software to decrypt rars, bzip2s, gzips, tars, etc. .
All this extra functionality results in vulnerabilities, eh?
Oh. Wait. Even when I get the file open, the trojan won't excute. Guess I better fire up Wine, see if I can get it to work.
If only Win32 was better supported in Linux, then I wouldn't have these cross-platform issues.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
aaahhh sooo... rinzip... doh... rin... doh.. fuckit RAR.
... because you can detect the part that does the self-extracting, of course. :)
A more clever approach is to have another program do the extracting for you - for example, to distribute it as a password-protected zip file and make the password known to the user. That way, you don't need the identifiable extractor.
"Lock and load, Brides of Christ!"
still any BOFH worth his salt wouldn't let any lusers runs executables anyway
It's about people clicking on RAR archives said to contain Anna Kournikova pictures, and other women with hot grits? Well what's new there?
:-P (of course a digitally signed one so they get a false sense of security)
It's not a problem with RAR in specific... If they block RAR files, I'm sure they could instead just be guided to a web page and told to install an ActiveX control instead.
If you could only patch the real serious security holes here -- the ones in the users' brains...
Beware: In C++, your friends can see your privates!
Time to go back to using ARJ
Yo, man, she's a nurse, cut her some slack.
You would be surprised how few email filters detect an attachment which is simply sent as Base64 or UUEncoded text, in the body. As it's not an attachment, it frequently gets ignored.
Why would we be surprised? People who write e-mail filters have to balance between security and convenience of the user.
I mean, imagine a super complex e-mail filter program that blocked every conceivable way of sending an attachment. If I sent a letter to my mom asking her how her stay was in the hospital, and got something back like:
"Your email was blocked because if you take the lower 4th bits of every word whose position is a prime number and reverse the endianess, you get a executable that runs on the 8-bit Gameboy platform, which could then be run by the recipient using an emulator. This executable has been blocked for your protection. Have a nice day."
I'd be pretty annoyed.
While that might seem an attractive option to some, helpdesk employees worldwide are screaming at the thought of the association for .doc and .rtf files suddenly switching to Wordpad.
"Why won't my Office work, and what is this silly 'wordpad' that started up?"
"What's the frequency Kenneth?"