This is WAAAY over my head but thought I would post it here so that those that actually understand Linux can discuss:
https://thehackernews.com/2025/08/linux ... cious.html
Linux Malware
-
AGTDenton
- Posts: 1614
- Joined: 15 Mar 2023 14:24
- Strap: I like cheese
- Location: UK - Berkshire
- CPU: Motherboard
- Mood:
- Has thanked: 614 times
- Been thanked: 409 times
Re: Linux Malware
That feels like it should have been found long ago.
What I can't quite understand is whether you need to have RAR file opener installed, like WinRAR, for it to work, or whether with Linux distros a RAR file opener is typically in-built to the OS
Server: i9 10940X, Asus Pro WS X299 SAGE II, 64GB, Mega RAID SAS 9440-8i
Desktop: Ryzen 5950X, MSI MEG X570S ACE MAX, 64GB, ASUS TUF 3080 Ti
Desktop: Ryzen 5950X, MSI MEG X570S ACE MAX, 64GB, ASUS TUF 3080 Ti
Re: Linux Malware
Looks simillar to a warning I saw a couple of days ago about WinRAR on Win.
If I followed that very detailed article correctly, it exploits a weakness in the structure of the RAR file format. The inferenence, as best as I remember it, was that you can stuff extra data into a RAR archive when you create it, that goes out of the bounds of where that data should be stored, leaving it kinda floating, in no man's land, as it were.
When you unpack that RAR (and the archived files will work as expected) that 'floating' data can, if properly structured, be used as a bit of executable code tat can then be used to downoad a payload from a malicious site, and run it at a pretty low level.
What that payload is, and does, could vary a lot. But you, the user, would have unpacked the archive, go the files you expected and be none the wiser. The proble, (IIRC), is that the RAR file structure allows that data to be overflowed into the parts of the file that shouldn't be capable of holding data at all. But can.
What wasn't entirely clear to me was whether the risk is specifically in the RAR file regardless of what's used to unpack it, or whether it needs a compromised RAR archive AND WinRAR itself. i.e. is there a risk if unpacking a compromised RAR using something other than WinRAR? And if you are using something else (as I do) is that "something else" immune, or will the risk still apply? And indeed, does the "something else" actually use vustom code or is it merely using some kind of DLL from WinRAR? my suspicion is that at least my "something else" is using such a DLL, 'cos I don't see the ned for them to re-invent the wheel.
My take-away? Unless and until a patch exists fixing this, if indeed it can be done given the main weakness is in the structure of the archive file at point of creation, is DON'T USE RAR FILES! ... on the logic of "better safe than sorry."
It seems extreme, but ....
Oh, and in case it wasn't clear ... it seemed from the article I read that this wasn't limited to Linux, either. I could be wrong though.
If I followed that very detailed article correctly, it exploits a weakness in the structure of the RAR file format. The inferenence, as best as I remember it, was that you can stuff extra data into a RAR archive when you create it, that goes out of the bounds of where that data should be stored, leaving it kinda floating, in no man's land, as it were.
When you unpack that RAR (and the archived files will work as expected) that 'floating' data can, if properly structured, be used as a bit of executable code tat can then be used to downoad a payload from a malicious site, and run it at a pretty low level.
What that payload is, and does, could vary a lot. But you, the user, would have unpacked the archive, go the files you expected and be none the wiser. The proble, (IIRC), is that the RAR file structure allows that data to be overflowed into the parts of the file that shouldn't be capable of holding data at all. But can.
What wasn't entirely clear to me was whether the risk is specifically in the RAR file regardless of what's used to unpack it, or whether it needs a compromised RAR archive AND WinRAR itself. i.e. is there a risk if unpacking a compromised RAR using something other than WinRAR? And if you are using something else (as I do) is that "something else" immune, or will the risk still apply? And indeed, does the "something else" actually use vustom code or is it merely using some kind of DLL from WinRAR? my suspicion is that at least my "something else" is using such a DLL, 'cos I don't see the ned for them to re-invent the wheel.
My take-away? Unless and until a patch exists fixing this, if indeed it can be done given the main weakness is in the structure of the archive file at point of creation, is DON'T USE RAR FILES! ... on the logic of "better safe than sorry."
It seems extreme, but ....
Oh, and in case it wasn't clear ... it seemed from the article I read that this wasn't limited to Linux, either. I could be wrong though.
Create an account or sign in to join the discussion
You need to be a member in order to post a reply
Create an account
Not a member? register to join our community
Members can start their own topics & subscribe to topics
It’s free and only takes a minute