Paying for WinRAR in all the wrong ways - Russia and China hitting ancient app
(2023/10/19)
- Reference: 1697666415
- News link: https://www.theregister.co.uk/2023/10/18/china_russia_winrar/
- Source link:
If you needed another reason to keep your installation of venerable decompression app WinRAR updated, Google's Threat Analysis Group says it has spotted a vulnerability patched in August being actively abused by multiple state-backed threat actors.
According to a blog [1]post on Monday, TAG has spotted Russian and Chinese-linked teams \ making use of [2]CVE-2023-38831 , which was [3]discovered by researchers from Group-IB over the summer and [4]patched in WinRAR version 6.23, released in early August.
Despite having been patched months ago, "many users still seem to be vulnerable," TAG noted.
[5]
The exploit relies on a pair of quirks, one in WinRAR and another in Windows' ShellExecuteExW function, ultimately resulting in malicious files hidden in a RAR archive being expanded and executed.
[6]
[7]
Invaders just need to add a space to an otherwise legitimate file, which confuses versions of WinRAR prior to 6.23 into temporarily expanding directories with the same name as the file, which is where the malware is hidden.
"If a directory is found with the same name as the selected entry, both the selected file and the files inside a matched directory are extracted to the root of a random temporary directory," TAG noted. WinRAR also performs path normalization, removing the appended spaces, because Windows doesn't allow trailing spaces in its file structure.
[8]
WinRAR then calls ShellExecuteExW to run the file originally selected by the user, and it's here the WinRAR's vulnerability gives way to issues in Windows.
"ShellExecute attempts to identify file extensions by calling 'shell32!PathFindExtension' which fails because extensions with spaces are considered invalid." Instead of giving up, "ShellExecute proceeds to call "shell32!ApplyDefaultExts" which iterates through all files in a directory, finding and executing the first file with an extension matching any of the hardcoded ones," such as .bat, .cmd or .exe, among others.
In Google's example, a file named "poc.png_" (with the underscore representing the appended space) is the original item the user selected, but WinRAR also expands an identically named directory "poc.png_/" and an identically-named file that's actually a shell script: poc.png_.cmd.
An archive for our pwn
TAG said Russian-linked [9]Sandworm and [10]APT28 gangs are abusing this appended space WinRAR exploit, with both using it against Ukrainian targets, among others.
Sandworm is using the exploit to target Ukrainians interested in training to become drone pilots with the Rhadamanthys infostealer, while APT28 is using it to deliver malware targeting Ukrainian energy infrastructure. In particular, APT28 has been using it to deliver a PowerShell script known as IRONJAW that steals browser login data and local state directories.
[11]We regret to inform you there's an RCE vuln in old version of WinRAR. Yes, the file decompression utility
[12]Behold… a WinRAR security bug that's older than your child's favorite YouTuber. And yes, you should patch this hole
[13]Don't panic. Google offering scary .zip and .mov domains is not the end of the world
[14]It looks like you're a developer. Would you like help upgrading Windows 11?
Chinese-linked [15]APT40 has been using the vulnerability against targets in Papua New Guinea, TAG said.
For those wondering if this is the same [16]WinRAR exploit we covered in August - no, it isn't, but it was patched in the same update. That vulnerability, [17]CVE-2023-40477 , had to do with a lack of full validation of user-supplied data when opening archives that allow memory access beyond the end of a buffer.
[18]
For those concerned about falling victim to such an exploit, we note that Microsoft announced the addition of [19]native support for non-zip compression formats like tar, 7-zip, gz and rar in May that was [20]added with the new Windows 11 file explorer last month, so you can finally ditch that third-party software. Or pay for it and get updates. ®
Get our [21]Tech Resources
[1] https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
[2] https://nvd.nist.gov/vuln/detail/CVE-2023-38831
[3] https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
[4] https://www.rarlab.com/rarnew.htm
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2023/08/31/sandworm_infamous_chisel/
[10] https://www.theregister.com/2023/05/02/russia_apt28_ukraine_phishing/
[11] https://www.theregister.com/2021/10/21/winrar_rce_vuln_positive_technologies/
[12] https://www.theregister.com/2019/02/20/winrar_security_bug/
[13] https://www.theregister.com/2023/05/17/google_zip_mov_domains/
[14] https://www.theregister.com/2023/09/27/it_looks_like_youre_a/
[15] https://www.theregister.com/2022/08/31/chinanexus_apt40_targeting_australian_government/
[16] https://www.theregister.com/2023/08/21/winrar_vuln_could_allow_code/
[17] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40477
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://theregister.com/2023/05/24/microsoft_rar_support_native_windows/
[20] https://support.microsoft.com/en-us/topic/september-26-2023-windows-configuration-update-542780c2-594c-46cb-979d-11116fe164ba
[21] https://whitepapers.theregister.com/
According to a blog [1]post on Monday, TAG has spotted Russian and Chinese-linked teams \ making use of [2]CVE-2023-38831 , which was [3]discovered by researchers from Group-IB over the summer and [4]patched in WinRAR version 6.23, released in early August.
Despite having been patched months ago, "many users still seem to be vulnerable," TAG noted.
[5]
The exploit relies on a pair of quirks, one in WinRAR and another in Windows' ShellExecuteExW function, ultimately resulting in malicious files hidden in a RAR archive being expanded and executed.
[6]
[7]
Invaders just need to add a space to an otherwise legitimate file, which confuses versions of WinRAR prior to 6.23 into temporarily expanding directories with the same name as the file, which is where the malware is hidden.
"If a directory is found with the same name as the selected entry, both the selected file and the files inside a matched directory are extracted to the root of a random temporary directory," TAG noted. WinRAR also performs path normalization, removing the appended spaces, because Windows doesn't allow trailing spaces in its file structure.
[8]
WinRAR then calls ShellExecuteExW to run the file originally selected by the user, and it's here the WinRAR's vulnerability gives way to issues in Windows.
"ShellExecute attempts to identify file extensions by calling 'shell32!PathFindExtension' which fails because extensions with spaces are considered invalid." Instead of giving up, "ShellExecute proceeds to call "shell32!ApplyDefaultExts" which iterates through all files in a directory, finding and executing the first file with an extension matching any of the hardcoded ones," such as .bat, .cmd or .exe, among others.
In Google's example, a file named "poc.png_" (with the underscore representing the appended space) is the original item the user selected, but WinRAR also expands an identically named directory "poc.png_/" and an identically-named file that's actually a shell script: poc.png_.cmd.
An archive for our pwn
TAG said Russian-linked [9]Sandworm and [10]APT28 gangs are abusing this appended space WinRAR exploit, with both using it against Ukrainian targets, among others.
Sandworm is using the exploit to target Ukrainians interested in training to become drone pilots with the Rhadamanthys infostealer, while APT28 is using it to deliver malware targeting Ukrainian energy infrastructure. In particular, APT28 has been using it to deliver a PowerShell script known as IRONJAW that steals browser login data and local state directories.
[11]We regret to inform you there's an RCE vuln in old version of WinRAR. Yes, the file decompression utility
[12]Behold… a WinRAR security bug that's older than your child's favorite YouTuber. And yes, you should patch this hole
[13]Don't panic. Google offering scary .zip and .mov domains is not the end of the world
[14]It looks like you're a developer. Would you like help upgrading Windows 11?
Chinese-linked [15]APT40 has been using the vulnerability against targets in Papua New Guinea, TAG said.
For those wondering if this is the same [16]WinRAR exploit we covered in August - no, it isn't, but it was patched in the same update. That vulnerability, [17]CVE-2023-40477 , had to do with a lack of full validation of user-supplied data when opening archives that allow memory access beyond the end of a buffer.
[18]
For those concerned about falling victim to such an exploit, we note that Microsoft announced the addition of [19]native support for non-zip compression formats like tar, 7-zip, gz and rar in May that was [20]added with the new Windows 11 file explorer last month, so you can finally ditch that third-party software. Or pay for it and get updates. ®
Get our [21]Tech Resources
[1] https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
[2] https://nvd.nist.gov/vuln/detail/CVE-2023-38831
[3] https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
[4] https://www.rarlab.com/rarnew.htm
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2023/08/31/sandworm_infamous_chisel/
[10] https://www.theregister.com/2023/05/02/russia_apt28_ukraine_phishing/
[11] https://www.theregister.com/2021/10/21/winrar_rce_vuln_positive_technologies/
[12] https://www.theregister.com/2019/02/20/winrar_security_bug/
[13] https://www.theregister.com/2023/05/17/google_zip_mov_domains/
[14] https://www.theregister.com/2023/09/27/it_looks_like_youre_a/
[15] https://www.theregister.com/2022/08/31/chinanexus_apt40_targeting_australian_government/
[16] https://www.theregister.com/2023/08/21/winrar_vuln_could_allow_code/
[17] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40477
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTCp57sWhAocv@fWJFJ3mgAAAA8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://theregister.com/2023/05/24/microsoft_rar_support_native_windows/
[20] https://support.microsoft.com/en-us/topic/september-26-2023-windows-configuration-update-542780c2-594c-46cb-979d-11116fe164ba
[21] https://whitepapers.theregister.com/
Re: WinRAR? Why?
Youngone
Many years ago, in a previous job, we sent a bunch of engineers to China to oversee the design and manufacture of some stuff, and all the drawings were compressed into .rar archives. The Chinese guys helpfully gave our guys a cracked version of Winrar to uncompress them and explained that .rar files were "better".
(No, I don't know what better means either).
Of course they all bought some weird keylogging virus back from China with them. Because of course they did.
Re: WinRAR? Why?
DoContra
For those that pony up for the license (and I know one of those in South America!!!!!!), more power to them. For the rest of us, 7z is a standard format, supported by multiple programs (including WInRAR!), has as near as makes no difference the same compression ratio, and only misses out on integrity/parity checking for split archives[1]. Right now 7-Zip hasn't adapted to the new Windows 11 right-click menu, but [1]NanaZip does.
PD: [2]Good enough excuse to remember this gem
[1]: While it hasn't been my experience, I was led to believe that (with the right create-time options) split rar files can recover from a corrupted part.
[1] https://github.com/M2Team/NanaZip
[2] https://www.youtube.com/watch?v=lX_pF03vCSU
WinRAR? Why?
For the last 20 years or more, all PCs, that friends and family sent me to repair, have a shareware copy of WinRAR! Why? 7Zip has been completely free (and better IMHO) for ages ¯\_(ツ)_/¯ The mystery remains.