Here you have my simple question about security of ZIP files, which turned out to be a very good readout, with a lot of useful answers and comments.ġ Try to send encrypted, password-protected ZIP containing EXE file via Gmail to see this "in action". Victim, without knowing above mentioned side-effects, may incorrectly assume, that archive hasn't been changed or its contents aren't altered, since he or she (the victim) is the only person, that knows the password. The attacker can alter contents of ZIP file, without knowing the password and claim to its victim that it is unchanged. Since contents of ZIP file can be changed, without knowing the password, by replacing a password-protected file with another one, we can speak about complete insecurity in psychological terms (social engineering, hacking etc.). Some people treats this as security leaks, stating that for this reasons, ZIP files are insecure, but other my assume that security is not violated, even with these mentioned "additions". So I'm mentioning this only as a possible side effects, you may be not aware of. ZIP files can also be " broken" in the meaning, that you can overwrite exisiting, password-protected file, stored inside ZIP file, with another file, named the same, without knowing the password.Īll these mentioned operations does not give attacker access to contents (he or she is still unable to extract data), only list it or destroy it. But keep in mind, however, that any program (or user), in any password-protected ZIP archive, can ( without knowing the password): In direct meaning, you mentioned ( extracting data), no.
0 kommentar(er)
