Slashdot Mirror
New Virus Attacks Via RAR Files
sscottsci writes "A new article at eWeek indicates that Virus writers are using .RAR files to bypass Filters and Anti-Virus systems to infect computers. Most anti-virus software cannot scan a .RAR file, and most firewalls do not block the extension yet."
Well it could definatly cause a problem with warez. Most warez is usually packed using RAR.
Ive been using rar extensions for years, never had a problem or complaint. Winrar is just as easy or easier to use then Winzip.....
All the common scanners can scan inside a zip archived file. However, most scanners cannot scan inside a rar archive. So you are getting it wrong. A virus scan OF the file will return nothing but a .rar file. The virus can be hidden IN the rar file, which is not scanned.
Hopefully your AV has a good realtime file scan so it if it written to a temp file it will be scanned as soon as it is accessed.
Boredom's not a burden anyone should bear.
ZIP files are inherently insecure (if you rely on the password protection anyways). RAR files are much more secure. Just try using one of those brute-force password cracking apps on a RAR file-- it takes significantly longer to brute force a RAR than a ZIP.
All I know about Bush is I had a good job when Clinton was president.
Which is a pity, since .rar files are so much more compressible than .zip files. The difference is roughly the same between .gz and .bz2... What would be really easy is for anti-virus writers to include a RAR decompression library and look inside the damned files, rather than reject useful technology for no good reason
The OSS program ClamAV supports scanning of RAR files. If most anti-virus programs truly don't support RAR format, this is another big win for ClamAV. (I run it on my own server, and as part of an anti spam/virus email service and it runs flawlessly).
AccountKiller
Just to point out that some places use stuff like UltimateZIP or something that'll handle all compressed archives, including ace and rar. It isn't just winrar that opens rar files.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
at least it is with my 2 subsidiaries there. Winzip does not do a Chinese version. RAR does.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
As the article explains it (you do read the articles ,don't you?). The .RAR has to be unpacked, to reveal a file with dual extensions - like "Pron.jpg.exe". .exe without running a virus scanner on it first. No one has made a .rar that somehow executes on its own. .exe's that came packed in .zip's, but this came packed in another compression. Duuh! it must be safe!". .rar or an .exe is, or they won't be fooled.
The user still has to be dumb enough to click on that
The article expresses a fear that there are people out there in cluelessland that will think "Gee, I know I should scan
There may be three people on the whole planet who are actually at that particular mix of clueless and clueful states. The rest either still don't know the first thing about what a
If a journalist tried to make us all afraid of the risk of terrorists that try to sneak through customs by disguising themselves as Mexican Banditos, complete with bandoleers of bullets, some people would probably buy that too.
Who is John Cabal?
Last time I looked at WinRAR it had no support for NTFS Permissions, unlike WinZip. Which makes it pretty useless for backups outside of the proverbial mom's basement.
What would be really easy is for anti-virus writers to include a RAR decompression library and look inside the damned files, rather than reject useful technology for no good reason
The FAQ claims that it doesn't open files produced by anything newer than WinRAR 2.9. Newer formats seem to be undocumented.
Umm, this is REALLY old news. This particular method of trying to sneak past virus scanners has been around since at least March 2004 (search Google for W32.Beagle@mm!rar).
I hope that served to teach you that e-mail is not a sensible mechanism to exchange executables.
Unfortunately, a malicious person can still e-mail a macro virus by merely changing a .DOC file's extension to .RTF. (Microsoft should prevent Word from running macros in files with .RTF extensions, but it doesn't.)
/ 001030oplivingston.html
http://www.infoworld.com/articles/op/xml/00/10/30
i had a test system get infected with a virus, and just as a test, I compressed the exe with ZOO, and none of the anti-virus programs would do anything about it, couldnt even detect it.
converted to a self-extracting file, and it was still invisible.
I even sent it off to NAV/SARC and McAfee, never heard a word back from them.
so yes, its possible and very easy to compress viruses in ways the anti-virus engines can't understand and they would slip right by...
LOL, yes, this is exactly why I use RAR, honestly! Jesus you're dumb.
You know, the horse and carriage has been a standard for a long long time now, so what is the point in getting around in something totally faster that then makes people go out and buy something just like it when in the end it does the same thing as that horse and carriage.
Clue: WinRAR compresses better, is more secure, and is a heck of a lot more feature rich than WinZIP. WinZIP is, to put it nicely, a piece of shit. And ZIP is outdated compared to RAR and 7-Zip (be it compression or security).
Your newbieness truly knows no bounds. Please educate yourself, don't worry, we'll all wait:
Now, STFU and sit.
All I know about Bush is I had a good job when Clinton was president.
Of course, RAR is not the best either...
Repton.
They say that only an experienced wizard can do the tengu shuffle.
RAR is better compression, and the compression ratio is all that matters. I had 1.2gb of binaries to fit on a CD, tar+bzip2 had it at around 780mb (gzip I interrupted at around 900mb). Arj was 706, but rar did it without breaking into a sweat: 636 mb, I had enough space for feather linux as well.
I am trolling
That made me kinda mad. The built in lib does rar up to 2.0, but won't look in 3.0s. What good is clamav with such a glaring hole in it?
Yeah, I could use the command line scanner with arcane options to use the unrar app, but that won't help my 5,000 email subscribers. So I'm bag to suggesting they use something like norton... (which technicall I never stopped recommending for obvious reasons).
Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
1) If you think 7z is a trivial algorithm to implement, you REALLY haven't looked at it. Also there isn't (last time I checked) any mac implementation
OK, the pzip people (p7zip project) have ported it to the posix command line. But you'll have to compile it yourself and write your own GUI. But you can at least work with 7zip archives now.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
In case you were serious, http://www.password-crackers.com/crack.html#ARJ
I am trolling
Bzip2 + tar gets as good compression as RAR and has the added benefit of being almost ubiquitous, as well as having decent open source tools for compression and extraction on virtually every platform. Multi-volume is simply a matter of calling split before storing it.
Those tests weren't all that great. bzip2 is great at text compression for example, but not good at other stuff. It makes no sense to test it on binary files. I've seen ACE better than RAR in some tests, results vary. Also, I didn't see 7-zip or a lot of the lesser known formats tested.
Actually, UNIX doesn't necessarily need the file extension - the kernel looks at the file's 'magic number' (as well as the executable bit) to decide if it should be executed and how to execute it.
Oolite: Elite-like game. For Mac, Linux and Windows
Well, I know of a few that do now... Seriously, is this that much of a threat? Winzip (AFAIK) doesn't handle Rar archives, and most users wouldn't know how to open one if they did find one in their inbox...
.rar archives being infected is very old news as well as every other archive format.
.rar files have been infected since they have existed and posted to USENET. Rar files are much better than zip files in that people can download (let's say) a .rar that's been split into 15 parts. By using smartpar, even if a part of that .rar is corrupted, Smartpar does parity and other checks to reconstruct the missing part(s)
.rar files prompts users to scan files for infections before extracting them.
As you note, most people don't know about rar files. And even if they do, the anti-virus program will block the virus as soon as the rar set is put back together.
This is a complete non-issue. Not to mention, Winrar, which creates and reassembles
This is not a dream, not a dream...we are transmitting from the year 1-9-9-9.
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
F-Prot has been scanning multivolume RAR archives since version 3, WITHOUT USING EXTERNAL UNRAR like ClamAV does.
Gmail blocks sending attachments of "executable" files, which includes .pl .exe .bat .com etc..., It even checks inside of zip, tar/gz archives to see if a file with matching extension is found. If it is found, gmail will not allow you to send your email.
On the other hand if you compress your archive using RAR, gmail cannot check the contents and thus does not complain about executable files.
The workaround is to open all received e-mail on Windows machines using the included WordPad program. It reads both .DOC and .RTF files, but can't run macros.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."