Packing files into archives like zips, tars, jars, wars, cpios, apks, rars and 7zs is a common way to keep important files and filesystem structures together when sharing them; it's also a source of potentially dangerous malware attacks.
In a new paper the security research organization Snyk details an attack they call Zip Slip, which exploits a bug in thousands of archiving and de-archiving utilities, including ones from HP, Amazon, Apache and Pivotal.
Zip Slip is a "directory traversal" attack, which exploits lax checking during unpacking, allowing the attacker to craft an archive that drops files in arbitrary directories anywhere on your hard drive, even overwriting key components.
Zip Slip Vulnerability [Snyk]
The Office of the Privacy Commissioner of Canada funded Screening Surveillance project: a trio of Creative Commons licensed short science fiction films about "everyday issues around big data and surveillance." The movies run about 10 minutes each, and come with classroom materials.
Time 4 Machine is a Ukrainian design shop led by Denis Okhrimenko; their latest project is "The most beautiful construction set in the world", a set of thin steel parts that you bend together to make (yes) beautiful mechanical models: a business-card case, a tractor, a working clockwork timer, a vintage sportscar, a springpowered cabriolet, […]
The bitter, yearslong debate at the World Wide Web Consortium over a proposal to standardize DRM for web browsers included frequent assurances by the pro-DRM side (notably Google, whose Widevine DRM was in line to be the principal beneficiary) that this wouldn't affect the ability of free/open source authors to implement the standard.
Ever wonder if you’re cleaning your teeth well enough? If your last dentist visit has you getting a little more thorough about oral care, it might be time to save yourself some guesswork. A lot of electric toothbrushes promise deep cleaning, but there’s a Platinum Sonic Toothbrush that has power plus the simple but effective […]
The digital age is well and truly upon us, but let’s not forget there’s a load of free TV content floating literally over our heads. No, we’re not talking about the internet. Signals from major broadcast networks are still gratis for anyone who can pick them up with an antenna. And before you envision those […]
Who said LEGO® had to be ground bound? With The Force Flyers DIY Building Block Fly ‘n Drive Drone, you can turn LEGO® and other building-block creations into fully-functional flying machines. It’s available now in the Boing Boing Store for $39.99. This kit comes with everything you need for remote-controlled long distance flight, including a […]