Hackers can use WinZip insecure server connection to drop malware

guest · Dec 10, 2020

Hackers can use WinZip insecure server connection to drop malware
December 10, 2020
https://www.bleepingcomputer.com/ne...p-insecure-server-connection-to-drop-malware/

The server-client communication in certain versions of the WinZip file compression tool is insecure and could be modified to serve malware or fraudulent content to users.
Clear-text traffic
WinZip is currently at version 25 but earlier releases check the server for updates over an unencrypted connection, a weakness that could be exploited by a malicious actor.
Click to expand...

Given the insecure nature of the communication channel, Rakhmanov says that the traffic can be “grabbed, manipulated, or hijacked” by an attacker on the same network as the WinZip user.

One risk stemming from this action is DNS poisoning, which tricks the application into retrieving a fake update from a malicious web server.

“As a result, unsuspecting user can launch arbitrary code as if it is a valid update,” Rakhmanov notes in a blog post today.
On registered versions of WinZip that are vulnerable, the attacker could also obtain potentially sensitive information such as the username and the registration code.
Click to expand...

Trustwave: Insecure Communication in WinZip 24 Could Lead to Malware

During observation of WinZip 24 network communications, I've noticed that it sends update check requests cleartext (HTTP). Same cleartext communication is utilized when Trial pop-ups are displayed and could be used to deliver malware to users’ computers.
Click to expand...

Log in or Sign up

Hackers can use WinZip insecure server connection to drop malware

guest Guest

Log in or Sign up

Hackers can use WinZip insecure server connection to drop malware

guest Guest

Useful Searches