Technology

37381 readers

222 users here now

Rumors, happenings, and innovations in the technology sphere. If it's technological news or discussion of technology, it probably belongs here.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

WinRAR zero-day exploited since April to hack trading accounts (www.bleepingcomputer.com)

submitted 10 months ago by [email protected] to c/[email protected]

22 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 7 points 10 months ago (2 children)

I use WinRAR (as a switch from 7-Zip) because it works well enough, is fast and stable and has good compression. For me, switching to another Windows archiver would have no merit.

[–] [email protected] 27 points 10 months ago (2 children)

Is security not a merit?

[–] [email protected] 4 points 10 months ago

Honestly, this is like the first time I heard WinRAR has this big security vulnerability. But I am still planning to stay on WinRAR given its easy to use UI and unlimited free trial.

[–] [email protected] 3 points 10 months ago (2 children)

It is. Coincidentally, security was one of the reasons to uninstall 7-Zip.

[–] [email protected] 11 points 10 months ago* (last edited 10 months ago) (1 children)

There's barely any CVEs on that page. It's likely a security researcher did some fuzzing of the executable and found a few issues at once.

Have you looked at how many vulnerabilities there's been in things like Windows, MacOS, Chrome, etc?

[–] [email protected] 1 points 10 months ago (1 children)

I have. The point is that there is no software without vulnerabilities.

[–] [email protected] 9 points 10 months ago (1 children)

The point is that there is no software without vulnerabilities.

Definitely true, but that conflicts with this:

Coincidentally, security was one of the reasons to uninstall 7-Zip.

If you uninstalled software because of security, you wouldn't have any software left :)

[–] [email protected] 1 points 10 months ago (2 children)

Also true. I was probably too impatient when I bought a WinRAR license over night. But now I have it and I use it. :-)

[–] [email protected] 8 points 10 months ago

I'm sure they're still celebrating someone purchasing a license :)

[–] [email protected] 8 points 10 months ago (1 children)

Y-you paid for WinRAR?

[–] [email protected] 3 points 10 months ago (1 children)

I even own legitimate Total Commander and mIRC licenses!

[–] [email protected] 2 points 10 months ago

Wow, a real unicorn! 🦄

[–] [email protected] 9 points 10 months ago

The number of reported issues seems to be about the same with WinRAR: https://www.cvedetails.com/vulnerability-list/vendor_id-1914/product_id-3768/Rarlab-Winrar.html

[–] [email protected] 7 points 10 months ago (1 children)

Is WinRAR really faster, more stable, and has better compression than 7-Zip? I haven't used WinRAR in probably over a decade at this point.

[–] [email protected] 2 points 10 months ago

It depends. The RAR5 format used by newer WinRAR versions (the "old" one is still supported just well) can have smaller archives than 7z, but the opposite is also true. Still, yes, WinRAR is in my experience faster and more stable.

(Note that "as small as possible" is not usually the most relevant point. The best compression is currently reached with the ZPAQ format, but using it with maximum compression settings is painfully slow.)