7-Zip gets Mark of the Web feature, increases protection for users
Credit to Author: Christopher Boyd| Date: Wed, 22 Jun 2022 13:28:30 +0000
One of the most popular zip programs around, 7-Zip, now offers support for “Mark of the Web” (MOTW), which gives users better protection from malicious files.
This is good news. But what does that actually mean?
In the bad old days, opening up a downloaded document could be a fraught exercise. Malicious files would often have full permission from the system to do whatever they wanted. Compromised PCs were the inevitable end result, and infected attachments were extremely popular. Outside of regular security tools, there often wasn’t much else available to help stop the flow.
Microsoft’s file block feature in 2007 meant network administrators could lock down any attempt to open specific file types. Unfortunately, this was a little too restrictive for some users. Files couldn’t be opened, even in cases where the user knew they were safe.
Microsoft changed things up a little in 2010, with Protected View.
Protected View: what is it?
Every time you download a spreadsheet or Word document and open it up, some checking takes place in the background. Downloaded files produce a yellow bar with the following message:
Protected View: Be careful. Files from the internet can contain viruses. Unless you need to edit, it’s safer to stay in Protected View.
This isn’t too different to the old file block feature, with a few key differences. Firstly, you can actually look at the document you want to open. As it is locked into a read-only mode, it can’t do anything malicious to your system. Secondly, users now have the option to enable editing. While there are other potentially dangerous aspects to opening downloaded files, Microsoft has solutions for those too. There is, of course, something telling these programs to warn you about potentially dangerous files. This is where MOTW comes into play.
How does Mark of the Web help?
MOTW is perhaps most recently known for blocking VBA code from running in Office. When a file is downloaded, Windows adds a ZoneId to the file which is responsible for the warning message(s). When the system detects the mark, the yellow bar is replaced by a red one. Unlike it’s yellow counterpart, there is no enable content button. Those files are done, with no way back.
Right click a file you’ve downloaded, and in General properties you should see a message which reads:
This file came from another computer and might be blocked to help protect this computer.
This exists thanks to MOTW.
The mark doesn’t exist on the file itself, which is left untouched. Originally an Internet Explorer security feature, you’ll now find it keeping you from harm’s way across the Microsoft product range.
Is this new addition a benefit for a zip program?
Absolutely. As noted by Bleeping Computer, MOTW didn’t apply to files extracted with 7-Zip. As a result, you’d have Office files opening as if you’d created them yourself with no Protected View in sight.
With this now enabled in the latest version of 7-Zip, some key Windows security precautions are now back in place.
There are some caveats to this story. As we know, not everybody pays attention to security warnings. Computer users routinely ignore all manner of security alerts from their operating system, browser, and security tools. The design and placement of warnings can further deter people paying attention to them. On top of all that, bogus security warnings can further make things confusing for users.
No matter how many warning messages are displayed, some people will still click “Enable” on files they shouldn’t. Even so, opening downloaded files with restrictions applied from the get-go can only be a good thing.
The post 7-Zip gets Mark of the Web feature, increases protection for users appeared first on Malwarebytes Labs.