All You Zombies

Posted by Bruce Schneier

https://www.schneier.com/blog/archives/2025/08/zero-day-exploit-in-winrar-file.html

https://www.schneier.com/?p=70599

A zero-day vulnerability in WinRAR is being exploited by at least two Russian criminal groups:

The vulnerability seemed to have super Windows powers. It abused alternate data streams, a Windows feature that allows different ways of representing the same file path. The exploit abused that feature to trigger a previously unknown path traversal flaw that caused WinRAR to plant malicious executables in attacker-chosen file paths %TEMP% and %LOCALAPPDATA%, which Windows normally makes off-limits because of their ability to execute code.

More details in the article.

https://www.schneier.com/blog/archives/2025/08/zero-day-exploit-in-winrar-file.html

https://www.schneier.com/?p=70599

Posted by Bruce Schneier

https://www.schneier.com/blog/archives/2025/08/friday-squid-blogging-squid-shaped-ufo-spotted-over-texas.html

https://www.schneier.com/?p=70572

Here’s the story. The commenters on X (formerly Twitter) are unimpressed.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

https://www.schneier.com/blog/archives/2025/08/friday-squid-blogging-squid-shaped-ufo-spotted-over-texas.html

https://www.schneier.com/?p=70572

Posted by Bruce Schneier

https://www.schneier.com/blog/archives/2025/08/trojans-embedded-in-svg-files.html

https://www.schneier.com/?p=70594

Porn sites are hiding code in .svg files:

Unpacking the attack took work because much of the JavaScript in the .svg images was heavily obscured using a custom version of “JSFuck,” a technique that uses only a handful of character types to encode JavaScript into a camouflaged wall of text.

Once decoded, the script causes the browser to download a chain of additional obfuscated JavaScript. The final payload, a known malicious script called Trojan.JS.Likejack, induces the browser to like a specified Facebook post as long as a user has their account open.

“This Trojan, also written in Javascript, silently clicks a ‘Like’ button for a Facebook page without the user’s knowledge or consent, in this case the adult posts we found above,” Malwarebytes researcher Pieter Arntz wrote. “The user will have to be logged in on Facebook for this to work, but we know many people keep Facebook open for easy access.”

This isn’t a new trick. We’ve seen Trojaned .svg files before.

https://www.schneier.com/blog/archives/2025/08/trojans-embedded-in-svg-files.html

https://www.schneier.com/?p=70594

Posted by Bruce Schneier

https://www.schneier.com/blog/archives/2025/08/llm-coding-integrity-breach.html

https://www.schneier.com/?p=70587

Here’s an interesting story about a failure being introduced by LLM-written code. Specifically, the LLM was doing some code refactoring, and when it moved a chunk of code from one file to another it changed a “break” to a “continue.” That turned an error logging statement into an infinite loop, which crashed the system.

This is an integrity failure. Specifically, it’s a failure of processing integrity. And while we can think of particular patches that alleviate this exact failure, the larger problem is much harder to solve.

Davi Ottenheimer comments.

https://www.schneier.com/blog/archives/2025/08/llm-coding-integrity-breach.html

https://www.schneier.com/?p=70587