March 19, 2019 By Shane Schick 2 min read

More than 100 unique exploits of a WinRAR bug have been identified since security researchers discovered a 19-year-old vulnerability in the file compression system.

Antivirus products may not immediately recognize persistent malware installed via the code execution flaw in the Windows-based utility, which was initially uncovered by Check Point. In a recent blog post, McAfee researchers noted that attackers are mostly targeting U.S. users, hoping to reach them before they install a patch that was released late last month.

WinRAR Bug Puts 500 Million Users at Risk

With a series of screenshots, McAfee illustrated a typical exploit that leveraged an illegal version of “thank u, next,” the hit song by pop singer Ariana Grande. Threat actors set up a payload containing malware in the Startup folder while a version of WinRAR containing the flaw extracted the MP3 file to a download folder.

User Account Control does not apply in this case, the researchers added, which means a user wouldn’t get a signal that the payload was installed. Once the system reboots, the malware starts running.

WinRAR is a popular tool with an estimated 500 million users, which means the scope for threat actors to pursue exploits is particularly large. It’s also common to see bootlegs such as the Ariana Grande song widely available on underground forums and torrent sites, which can provide plenty of opportunity to take advantage of the flaw.

No, Thank You: How to Avoid the WinRAR Bug

While the best recourse for most users is to simply avoid suspicious downloads and apply the patched version, WinRAR 5.70, that may not be enough to protect entire organizations. According to IBM experts, there is often a disconnect between IT security teams and operations teams when it comes to information related to critical software patches.

With the right patch posture reporting tools, security professionals can conduct a comprehensive assessment of devices that may be vulnerable to something like the WinRAR bug, then filter and sort data based on the most appropriate remediation priority. Given how quickly threat actors are trying to capitalize on this flaw, there’s no time to lose.

More from

When you shouldn’t patch: Managing your risk factors

4 min read - Look at any article with advice about best practices for cybersecurity, and about third or fourth on that list, you’ll find something about applying patches and updates quickly and regularly. Patching for known vulnerabilities is about as standard as it gets for good cybersecurity hygiene, right up there with using multi-factor authentication and thinking before you click on links in emails from unknown senders.So imagine my surprise when attending Qualys QSC24 in San Diego to hear a number of conference…

The straight and narrow — How to keep ML and AI training on track

3 min read - Artificial intelligence (AI) and machine learning (ML) have entered the enterprise environment.According to the IBM AI in Action 2024 Report, two broad groups are onboarding AI: Leaders and learners. Leaders are seeing quantifiable results, with two-thirds reporting 25% (or greater) boosts to revenue growth. Learners, meanwhile, say they're following an AI roadmap (72%), but just 40% say their C-suite fully understands the value of AI investment.One thing they have in common? Challenges with data security. Despite their success with AI…

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today