This fan-favorite Windows application is vulnerable to various malware attacks

Cybersecurity solution provider Trustwave has identified a number of vulnerabilities in the WinZip file compression software that could be used to inject malware into a user’s device. The insecurities reside within the server-client communication channel.

According to Trustwave, some versions of WinZip communicate with the server via an unencrypted connection when looking for updates, sending requests in cleartext. 

As a result, the HTTP connection can easily be taken over by a threat actor and used as a way of stealthily inserting malware.

• We've put together a list of the best compression tools around
• Here's our list of the best file managers
• Also, check out our roundup of the best cloud storage solutions

“Since HTTP is unencrypted cleartext, it can be grabbed, manipulated, or hijacked by anyone with the ability to see that traffic,” Martin Rakhmanov, security research manager at Trustwave’s SpiderLabs team, explained. 

“This means anyone on the same network as a user running a vulnerable version of WinZip can use techniques like DNS poisoning to trick the application to fetch ‘update’ files from a malicious web server instead of a legitimate WinZip update host. As a result, unsuspecting users can launch arbitrary code as if it is a valid update.”

Threat mitigation

Other issues were also discovered by Trustwave researchers. For example, WinZip sends potentially sensitive information, including usernames and registration codes, over the same unencrypted channel when sending update requests. This means that an attacker could easily gain access to this information too.

Furthermore, in WinZip version 24 – the program has since been updated – pop-up windows that appear during Trial mode would be easily manipulated by a network adjacent attacker. It would be possible, therefore, to execute arbitrary code that would look as though it had come directly from WinZip servers.

The easiest way for users to safeguard themselves against these malware attacks is to upgrade to WinZip 25, as this version uses HTTPS for its server communications. If an upgrade is out of the question, users should disable automatic update checks to stay safe.

• We've also highlighted the best WinZip alternatives