At the end of February 2019, Check Point specialists reported a serious vulnerability (CVE-2018-20250) in WinRAR and demonstrated how it worked. Nearly all of WinRAR’s 500 million users were exposed to the risk, as the identified problem had existed for about 19 years in the archiving code.
The vulnerability is tied to the old third-party UNACEV2.DLL library: it turned out that you could create a special ACE archive which, once extracted, could place a malicious file in an arbitrary directory, bypassing the actual extraction path (for example, adding a malicious program to autostart).
The problem was eliminated with the release of WinRAR 5.70 Beta 1 in January of this year. The developers decided to drop support for the ACE format.
Nevertheless, the first attacks exploiting the vulnerability were noticed by experts in February. Spammers then began sending malicious archives in their emails, which, once extracted, infect the victim’s machine with a backdoor. Malefactors used the most varied “bait” for victims, ranging from explicit photos and technical documentation to political news.
McAfee analysts published a report stating that the attacks were continuing and that many hacker groups were trying to exploit this vulnerability. For example, one of the groups disguised its malware as the Ariana Grande album Thank U, Next.
Researchers have identified more than 100 unique exploits for this problem and note that this is no surprise. WinRAR, with its vast user base, is an excellent target for intruders. After analyzing user account control, the user sees no warning message. Malware simply starts running after the next system startup.
