.zip domains

[ghost]

Should some of these be blocked in uAssets?

some people have expressed concern for cybersecurity

[stephenhawk8054]

We just block real cases.

[ghost]

https://www.youtube.com/post/UgkxmgiPVxBlrILj5upj-dg1UE8nWoejbZmg

42. zip

https://youtu.be/LFriS1PICE0?t=49

familyphotos. zip

[Yuki2718]

Please do file an issue ticket one per site with enough and clear information why each domain should be blocked.

[ghost]

I dont have time to set up a VM now; the concern is that people could accidentally click on the domain and download the file
if they think it is the intended file, they could trust it

[Yuki2718]

I dont have time

Note this applies to us as well. We're all volunteer.

[krystian3w]

42 is zip bomb:

• https://www.virustotal.com/gui/file/4632c001bc34f77bff5e7d352088033ea2f339f8c477461057d5a1fa340e46e2?nocache=1
• scan at metadefender.opswat.com covered only Avira (as zip bomp too) and may frozen (now mark file as unsupported).

files tree generated by Notepad / uBo resource viewer after lite clean up:

  $ lib 0.zip
              Oh  Vs  Vs PK
  $ lib 1.zip
        Oh  Vs  Vs PK V	$ ,lib 2.zip
        Oh  Vs  Vs PK V	$ Blib 3.zip
        Oh  Vs  Vs PK V	$ X(lib 4.zip
        Oh r}Xs r}Xs PK V	$ n2lib 5.zip
        Oh r}Xs r}Xs PK V	$ <lib 6.zip
        Oh r}Xs r}Xs PK V	$ Flib 7.zip
        Oh r}Xs r}Xs PK V	$ Plib 8.zip
        Oh r}Xs r}Xs PK V	$ Zlib 9.zip
        Oh r}Xs r}Xs PK V	$ dlib a.zip
        Oh r}Xs r}Xs PK V	$ nlib b.zip
        Oh r}Xs r}Xs PK V	$ ylib c.zip
        Oh 2@]s 2@]s PK V	$ lib d.zip
        Oh 2@]s 2@]s PK V	$ 4lib e.zip
        Oh 2@]s 2@]s PK V	$ Jlib f.zip
   Oh PK

family images still looks clean:

• https://www.virustotal.com/gui/file/9b6abb1abe7b87e294dc88cfb4c3073290598daf57e78edaf57e95fcd9ec2f01?nocache=1, https://archive.org/details/archive.zip

[ryanbr]

Just because its a .zip or .mov domain, outright block will be an overkill imo.

[ghost]

I get that, and I'm not advocating for blocking all .zip domains in uAssets
However, $doc-blocking for specific cases could warn the user that they are about to access a website rather than a file. Maybe a more niche security list could have a similar approach.

[ryanbr]

the media attention on .zip domains its just a scaring everyone probably unessarily

[ghost]

well maybe browsers shouldn't automatically download files by default in the first place

[Yuki2718]

$doc-blocking for specific cases could warn the user that they are about to access a website rather than a file.

What is differnt from what we do currently? There's nothing special to .zip.

[iam-py-test]

specific cases could warn the user that they are about to access a website rather than a file

Best left to a specialized security list IMO.