Printable Version of Topic

Click here to view this topic in its original format

HTMLHelp Forums _ Off Topic _ Microsoft is scanning the inside of password-protected zip files for malware

Posted by: Christian J May 18 2023, 06:29 AM

https://arstechnica.com/information-technology/2023/05/microsoft-is-scanning-the-inside-of-password-protected-zip-files-for-malware/

"Brandt said that last year Microsoft’s OneDrive started backing up malicious files he had stored in one of his Windows folders after creating an exception (i.e., allow listing) in his endpoint security tools. He later discovered that once the files made their way to OneDrive, they were wiped off of his laptop hard drive and detected as malware in his OneDrive account.

“I lost the whole bunch,” he said."

Posted by: pandy Jun 20 2023, 05:37 AM

QUOTE(Christian J @ May 18 2023, 01:29 PM)

https://arstechnica.com/information-technology/2023/05/microsoft-is-scanning-the-inside-of-password-protected-zip-files-for-malware/

"Brandt said that last year Microsoft’s OneDrive started backing up malicious files he had stored in one of his Windows folders after creating an exception (i.e., allow listing) in his endpoint security tools. He later discovered that once the files made their way to OneDrive, they were wiped off of his laptop hard drive and detected as malware in his OneDrive account.

“I lost the whole bunch,” he said."

I missed this thread until someone spammed in it.

But isn't that to be expected if you have real time protection on? Do something with file they think is malware and it's nuked. Even open the folder where such a file resides and it's a gonner. I have such files too. I always turn real time protection of before I open such a folder or I lose the files. We don't know if he had real time protection on, but if he hadn't I think he should have mentioned that.

Posted by: Christian J Jun 20 2023, 08:31 AM

What's new about it is that MS tries to access password-protected files...

Posted by: pandy Jun 21 2023, 10:41 AM

Oh. I thought they already did that?