Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319


This fan-favorite Windows application is vulnerable to various malware attacks

Image Description

Cybersecurity solution provider Trustwave has identified a number of vulnerabilities in the WinZip file compression software that could be used to inject malware into a user’s device. The insecurities reside within the server-client communication channel.

According to Trustwave, some versions of WinZip communicate with the server via an unencrypted connection when looking for updates, sending requests in cleartext. 

As a result, the HTTP connection can easily be taken over by a threat actor and used as a way of stealthily inserting malware.

“Since HTTP is unencrypted cleartext, it can be grabbed, manipulated, or hijacked by anyone with the ability to see that traffic,” Martin Rakhmanov, security research manager at Trustwave’s SpiderLabs team, explained

“This means anyone on the same network as a user running a vulnerable version of WinZip can use techniques like DNS poisoning to trick the application to fetch ‘update’ files from a malicious web server instead of a legitimate WinZip update host. As a result, unsuspecting users can launch arbitrary code as if it is a valid update.”

Threat mitigation

Other issues were also discovered by Trustwave researchers. For example, WinZip sends potentially sensitive information, including usernames and registration codes, over the same unencrypted channel when sending update requests. This means that an attacker could easily gain access to this information too.

Furthermore, in WinZip version 24 – the program has since been updated – pop-up windows that appear during Trial mode would be easily manipulated by a network adjacent attacker. It would be possible, therefore, to execute arbitrary code that would look as though it had come directly from WinZip servers.

The easiest way for users to safeguard themselves against these malware attacks is to upgrade to WinZip 25, as this version uses HTTPS for its server communications. If an upgrade is out of the question, users should disable automatic update checks to stay safe.


11 Dec 2020



Other Blog

  • Half-Life: Alyx could be just the start, as Valve confirms more single-player games

    Valve president Gabe Newell has confirmed that more games are on the way from Valve, but will they be in VR for the Valve Index?

    Read More
  • You're wrong about the environmental impact of video streaming - here's why

    Video streaming has been given a bad name when it comes to climate change, but is it really as bad as you think?

    Read More
  • The best cheap MacBook Pro deals, prices and sales in October 2020

    We're bringing you all the best cheap MacBook Pro deals and sales, with the lowest prices around.

    Read More
  • This malicious Firefox extension will drain your crypto wallet

    Fake cryptocurrency add-on listed on official Mozilla add-ons website for several months.

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us