Patched WinRAR Bug Still Under Active Attack—Thanks to No Auto-Updates

Why? Because the WinRAR software doesn’t have an auto-update
feature, which, unfortunately, leaves millions of its users
vulnerable to cyber attacks.

The critical vulnerability (CVE-2018-20250) that was patched
late last month by the WinRAR team with the release of WinRAR
version 5.70 beta 1 impacts all prior versions of WinRAR released
over the past 19 years.

For those unaware, the vulnerability is “Absolute Path Traversal”
bug that resides in the old third-party library UNACEV2.DLL of
WinRAR and allows attackers to extract a compressed executable file
from the ACE archive to one of the Windows Startup folders, where
the malicious file would automatically run on the next reboot.

Therefore, to successfully exploit this vulnerability and take
full control over the targeted computers, all an attacker needs to
do is just convincing users into opening a maliciously-crafted
compressed archive file using WinRAR.

Now, security researchers from McAfee reported that they
identified more than “100 unique exploits and counting” in the
first week since the vulnerability was publicly disclosed, with
most of the initial targets residing in the United States.

One recent campaign spotted^[3] by the researchers
piggybacks on a bootlegged copy of an Ariana Grande’s hit album,
which is currently being detected as malware by only 15 security
products, whereas 55 antivirus products fail to alert their users.

The malicious RAR file
(Ariana_Grande-thank_u,_next(2019)_[320].rar) detected by McAfee
extracts a list of harmless MP3 files to the victim’s download
folder but also drops a malicious EXE file to the startup folder,
which has been designed to infect the targeted computer with
malware.