1

Let’s say there is a .zip file that contains either a virus, malware or something harmful for the computer.

The computer is running a Unix-like OS, e.g. Ubuntu 18.04.

Are there any security implications by only unpacking the contents of the .zip file?

Improve this question

1 Answer 1

Reset to default
6

Yes, there can be.

The main risk with unpacking zips is that it overwrites an executable or config file. For example, if the zip contains a .bashrc and you extract it in your home directory then it could overwrite yours and the next time you log in, the attacker's code will run.

For a worst-case scenario, consider a webserver that open zip archives, maybe from user uploads, because unzip will run the the same privilege as the webserver process, likely being able to overwrite executables or config files belonging to the webserver. Hopefully the admin isn't sloppily running the webserver process as root.

There was a recent public vulnerability called Zip Slip which made this even worse: some unzipping tools were allowing filenames to contain .. within a zip archive, which makes this attack even more dangerous because a zip containing the following file will overwrite /bin/ls no matter where in your filesystem you're trying to extract it to:

../../../../../../../../../../../../../../../../../bin/ls

(or any other executable that the extracting process has permission to overwrite)

Proper zip extracting hygiene:

  1. If possible, check the authenticity of the zip archive before you extract it (you got it from somewhere trustworthy, checksum, signature, etc).
  2. If possible, avoid running unzip as root, that way system files can't be overwritten.
  3. If possible, unzip into a new clean directory so that, barring chroot exploits like Zip Slip above, there is nothing in that folder to overwrite.
Improve this answer
8
  • 2
    This only applies when the extraction is done as the root user. A regular user does not have write permissions on the mentioned binaries.
    – Jeroen
    Commented Nov 17, 2018 at 17:41
  • 2
    @Jeroen-ITNerdbox ... how about overwriting your .bashrc ? Also dangerous?
    – Mike Ounsworth
    Commented Nov 17, 2018 at 17:47
  • 1
    While this is true, it does not affect binaries as stated in your example.
    – Jeroen
    Commented Nov 17, 2018 at 19:03
  • I added a mention of .bashrc. is that what you wanted?
    – Mike Ounsworth
    Commented Nov 17, 2018 at 19:15
  • It's not so much that I wanted you to add something about .bashrc although that is a more realistic example. I was trying to make clear that as a regular user it is not common to sudo to root, extract a malicious zip archive that over writes existing binary files.
    – Jeroen
    Commented Nov 17, 2018 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .