Hackers discard malware through a free winzip trial pop-up window vulnerability

Researchers have found a serious security vulnerability in 24, which is targeted at users with malware. Winzip trial pop-up window vulnerability allows hackers to execute arbitrary code execution and DNS poisoning.

The free text about the trial version of will not be displayed when the request for a free update is sent via http. It is reported that the vulnerability exists in the way of winzip communicating with the server, which makes it vulnerable to exploitation by malicious participants who provide through the vulnerability. Winzip can download zip tool program for free, which can compress and decompress files easily. It enables users to compress and decompress almost all file formats, including zip, tar, rar, etc. However, the tool can be used online free of charge during the trial period, and users need to purchase a license to obtain a license to continue to take full advantage of its services. The tool repeatedly checks the user’s software status over a period of time. Once the probation period is detected to have expired,

In between, attackers can intercept traffic and interfere with the text being conveyed and add an infected version of winzip. In addition, since the update request also contains the user’s personal data, such as “registered user name”, “registration code” and other necessary information for processing the request, the user’s concern is aggravated. An can also access this information by trying to pop up a window.

“Winzip 24 will open a pop-up window from time to time when running in trial mode. Because the contents of these pop-up windows are HTML with JavaScript and can also be retrieved through HTTP, it is easy to manipulate these contents for attackers in neighboring networks. ” Provided by researchers at trustwave.

“As part of the update request, the application sends potentially sensitive information in the query string, such as the registered user name, registration code, and other information. Because this is through an unencrypted channel, the can see this information completely. “

“This means that anyone on the same network as a user running a vulnerable version of winzip can use techniques such as DNS poisoning to trick applications into obtaining” update “files from a malicious web server rather than a legitimate winzip update host. As a result, unsuspecting users can launch arbitrary code as if it were a valid update. ” The researchers added.