How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
How safe is it to decompress untrusted files
Just looking at the CVE's for unzip you will find several possible code executions, modifying the permissions of existing files, overwriting arbitrary files outside the current directory....
The CVE list for unrar is shorter but includes also code execution.
What steps can be taken to minimize the threat while extracting the file's contents?
Any kind of privilege separation and sandboxing, i.e. virtual machines, chroot environment or containers, ... And of course have the latest patches.
There is actually nothing special about unzip and unrar - you should take the same care with any kind of potentially malicious files (which includes at least everything with suspicious origin).
Malicious payload contained in a file must be run so that it can be used. Merely deposing a file on a filesystem does not present a risk, provided that:
- there is no action triggered automatically once a file of a given type is discovered. This is usually done by graphical UIs which want to be smart and, for instance, generate thumbnails
zipfile itself is not crafted in a way which will, for instance, create recursive directories until you run out of inodes (or other resources)
If you have doubts use a throwaway virtual machine without a GUI which you will snapshot after installation and run from that snapshot for sensitive operations.
I suggest looking at the files size and content. Sometime in June 2015 my place of employment where I work as IT got hit by cryptoware. I was tasked with finding out where it came from and what it effected.
After a few hours I tracked it down to a single zip attachment on an email. It was just under 300 bytes. Double clicking the email cause it to inject code into the built in windows zip program which then downloaded the cryptoware and installed it from the users temp directory. This was a windows XP machine. I removed execution privileges from the temp folders and that fixed the issue. A few days ago we got another present in the mail but this time it errored out since it couldn't execute.
I would have to say that most if not all cryptoware and other little nasties are targeting windows exclusively. If you're using Linux you're probably fine. Just isolate the file first. I agree with Steffen Ullrich on that point.
On a side note, we didn't give in to terrorism. We brought the effected files back from backup. Always keep a good set of backups.