In this post, we are going to discuss how WinRAR has patched serious security faults last month, one of the world’s most popular Windows file compression applications, which can only be exploited by tricking a WinRar user to extract malicious archives. The vulnerability identified last year by research.checkpoint.com affects all versions released in all WinRAR over the past 19 years.

More About Evil Winrar

CVE-ID: CVE-2018-20250, CVE-2018-20251, CVE-2018-20252, and CVE-2018-20253

Patched Version: WinRAR 5.70 Beta 1

This vulnerability is due to the UNACEV2.DLL library included with all versions of WinRAR. The winrar uses the ACE format to compress the folder and unpack the compressed folder with the help of UNACE.DLL.

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path. This happens due to improper compilation when unace.dll come into the face.

Let’s download a python script that will generate a malicious file archive in a rar format. Once you download the python script, install the dependency required for it.

Further, you need to give full permission to the python script inside the Evil-Winrar-Gen folder and then generate a malicious exe file with the help of msfvenom and name as “winrar.exe” as shown and multi handler inside Metasploit.

Now create a text file that will display to the victim when he extracts the rar file to confuse him. Then execute evilWinrar python script along with malicious exe file and text file, creating a malicious archive that you can send to the target.

As said, this vulnerability allows us to extract the malicious file in the arbitrary path, with the help of this script we will allow rar files extraction in the /startup program. Now use social engineering for transferring the malicious rar to the victim and wait for the victim to restart his machine to obtain reverse connection of the target.

There is currently no startup program in the target machine as shown below. Once the victim extracts the malicious rar file “evil.rar,” our winrar.exe backdoor will extract from the startup program.

To ensure for winrar.exe file in the startup folder, type shell:startup in the run prompt.

As soon as the victim will restart the machine, you will get a reverse connection as shown.

Author: Aarti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

Every business organization seeks safety and security of its internal information. It is essential to ensure that the data is protected from malicious attackers who easily breach into the network through use of unfair practices. Maintaining a secure information security policy and hiring the right bunch of qualified professionals is of prime importance to any organization who intend to prevent their internal servers and systems from being compromised. Such professionals ensure that the software installations are up-to-date and build in security layers which become difficult for cyber attackers to intrude into the network.

What is CISSP?

The full form of CISSP is Certified Information Systems Security Professional. This certification is conferred by the International Information Systems Security Certification Consortium (ISC)², which is a global non-profit organization specializing in IT security. (ISC)² is rendered as one of the world’s largest Information Security organization which offers a variety of security certifications like CISSP, CSSLP, and CAP.

As an Information Security aspirant, there are multiple benefits of obtaining a CISSP certification which you simply cannot ignore. Let’s discuss some of the topmost reasons to earn such a certification and discover how a CISSP is integral for any business organization and act as a key component in the selection procedure for managerial-level information security positions.

• Global Recognition

Obtaining a CISSP certification is a good move for a flourishing IT career. Reason being, CISSP provides industry-wide recognition  and considered as the “Best Professional Certification Program” by SC Magazine. This certification is highly endorsed and recognized by well-known global MNCs like Google, IBM etc. It is ascertained that there is a projected requirement of about 56% of cyber experts in the current job market.

• (ISC)² Membership

You are eligible to earn an (ISC)² membership once you complete the CISSP certification. This membership offers a wide array of resources and advantages which help you to improve your knowledge area and network. You just need to invest on some maintenance fees annually to retain the membership. As a member, you also stand a chance to earn discounts on industry seminars and conferences and have free access to certain online events. Your credentials are available online through digital badges. The scope of benefits of a member are immense and opens a world of possibilities for you to stay connected with the latest findings and resources.

• Job Competency

The core content of CISSP provides a wide range of understanding of the security field to the information security professionals and creates an awareness of the latest security threats. This certification encompasses knowledge transfer of control devices and the network architecture to maintain the integrity and confidentiality of public and private networks. The course content is designed in such a way that it involves the application of security concepts and the best practices for software development, enterprise computing solutions in the production and operation environment.

• Increased Earning Potential

Getting a CISSP certification under your belt not only assures you of advanced knowledge and skill-sets but also command higher remuneration. In 2017, there were around 1 million job openings in cybersecurity which is likely to go beyond 1.5 million by 2019. Organizations are continuously competing to hire the best security talent in the market and are ready to pay handsome salaries to the prospective candidates. On an average, a CISSP earns 25% more than the non-certified counterparts.

• High Demand for Security Experts

On a global scale, companies are investing more on hiring CISSP certified experts. With the ever-increasing intensity of hacker activities across the world, organizations are struggling to keep at bay such security breaches which hamper their internal security fabric. For this reason, employers are recruiting certified cybersecurity experts to prevent such network intrusion by building stronger security layers thereby protecting their internal servers and systems from malicious attacks.

Takeaway

Considering all these factors that has been discussed in this article, we can safely connote that obtaining a CISSP certification can certainly propel your IT career to a great extent. CISSP is thus, a very well-performing certification and once you are through the certification, it provides you a rewarding, lucrative and satisfying career path in the long run.

Author Bio: I am Maria Thomas, Content Marketing Manager and Product Specialist at GreyCampus with eight years rich experience on professional certification courses like PMI- Project Management Professional, PMI-ACP, Prince2, ITIL (Information Technology Infrastructure Library), Big Data, Cloud and Six Sigma.

It’s generally believed that an SSL certificate is just a minor collection of the data files that digitally bond the cryptographic key to the businesses’ details. Everyone supposedly knows that without the SSL certificate, all of the proper secure data on the website could get intercepted and used for blackmailing, identity theft, etc. Likewise, the certificate is important as a mean of forming the trust in the website and the commercial customer attraction. All of the listed benefits could be exploited by using the service, called CertDB, or by figuring out each one of them manually. Thanks to the user friendly interface of the service, however, I think it’s a worthwhile option for those only starting to wonder if the SSL certificates have the ability to change the nature of things around us.

The CertDB is an SSL certificate search engine that could be used for the various purposes. First of all, it allows the companies who specialize in the security breaches to find the problematic certificates with the aim of weakening the possibility of the hacker attacks. The service also functions as a useful tool during the penetration tests. Not to forget to mention that with the help of the certificate analysis one may discover the subdomains and domains of the particular focus that could turn to be vulnerable. Such an information may be used not only for the security but also in a profitable way. A commercial SSL-selling company, for example, could boost its own sales by warning those suffering from the “holes” in the system. Although, there is clearly no need to think of CertDB as os some advanced mechanism that is of no use to the non-experts on the internet. On the opposite, the service could turn to be truly practical, regardless of the fact that the creators position their service primarily for the research.

Have you ever wondered how come a simple internet user may figure out the plans of the entire company? Despite the various establishments’ enormous efforts to remain free of private info breaches and the strict non-disclosure deals, which could keep secrets for as long as desired, things could get leaked pretty easily. By exploiting the direct searching software of CertDB, one can surely find the newly-released SSL certificates that could be used for gathering the info, such as the company’s used domains, subdomains, and IP addresses. Thus, such a data could help the owner to interpret it in the variety of ways. For instance, the company may have just registered the domain indicating the upcoming start of the initial coin offerings (ico.xxx.com). This small piece of evidence may be actually crucial as it can be used for the competitive analysis and other business analytics among others. Sometimes, the company of the focus may issue the certificate in an organization with the domains of the other companies, which could mean the collaboration or the purchase of one company by another. Clearly, such a data could potentially benefit the owner as it can generate profits as an insight info or even lead to the start of the investigation (if there are hints of the unfair business practices). I, personally, find this to be truly appealing as CertDB has the promising power to shape the entire industries with its innovative and useful searching engine.

CertDB is clearly an unparalleled project, and there is an obvious need to mention the people working behind the doors of it. The SSL certificate search engine is only possible due to the SPYSE team of highly-skilled security specialists and IT experts of the area that constantly work on the IT projects all across the globe. Besides, it’s fair to claim that the innovation is continuous, which is something that personally fascinates me. As I was writing this article, the SPYSE team has just released the subdomain searching tool (findsubdomains.com) that looks promising to me after doing the first-hand analysis. I will attempt to fully review the newly-released service in the short time, although there is one outstanding thing that I should already mention, being the free using cost of the service. It seems to me that the entire SPYSE team is functioning with the waves of enthusiasm in mind. Besides, there is a manifest sign of professionalism as can be seen by the capabilities of the CertDB website.

More should be said about the project’s mission and why it has come to exist with the effort of the SPYSE team mentioned above. The inventors of CertDB hold a belief that the internet is developing at an incredibly rapid speed, which only furthers the issues of data security and privacy concerns that could potentially happen in any web project of the focus. To this end and with the purpose of disclosing the hidden info to the public, CertDB keeps functioning for the needs of the average users who want to know more about the various companies and conglomerates. The fact that CertDB, an internet-wide SSL search engine, exists allows to both browse the “outdated” data as well as to obtain the newly-published one. Frankly, such things could change the way I look on the use of data, which is something I don’t say that much often.

Every time I want to stick my nose where it does not belong, I do realize that CertDB is the best option for me to use in such a situation. It’s free of charge, has the most accurate database of the SSL certificates and is easy to use for those inexperienced with the web surfing processes. Personally, I would continue to use CertDB and exploit all of the service’s benefits. Although, I hope that you have been able to reconsider your position on the importance of the SSL certificates.