Trustwave achieves verified MXDR solution and FastTrack ready partner status from Microsoft. Learn More

Trustwave achieves verified MXDR solution and FastTrack ready partner status from Microsoft. Learn More

Managed Detection & Response

Eradicate cyberthreats with world-class intel and expertise

Managed Security Services

Expand your team’s capabilities and strengthen your security posture

Consulting & Professional Services

Tap into our global team of tenured cybersecurity specialists

Penetration Testing

Subscription- or project-based testing, delivered by global experts

Database Security

Get ahead of database risk, protect data and exceed compliance requirements

Email Security & Management

Catch email threats others miss with layered security & maximum control

Co-Managed SOC (SIEM)

Eliminate alert fatigue, focus your SecOps team, stop threats fast, and reduce cyber risk

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
The Trustwave Approach
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Platform
SpiderLabs Fusion Center
Security Operations Centers
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Insecure Communication in WinZip 24 Could Lead to Malware


During observation of WinZip 24 network communications, I've noticed that it sends update check requests cleartext (HTTP). Same cleartext communication is utilized when Trial pop-ups are displayed and could be used to deliver malware to users’ computers.

First Finding

You can see a screenshot of a Wireshark capture of the update request in Figure 1 below.


Figure 1: Packet capture of the WinZip 24 update request


Since HTTP is unencrypted cleartext, it can be grabbed, manipulated, or highjacked by anyone with the ability to see that traffic. This means anyone on the same network as user running a vulnerable version of WinZip can use techniques like DNS poisoning to trick the application to fetch “update” files from malicious web server instead of legitimate WinZip update host. As a result, unsuspecting user can launch arbitrary code as if it is a valid update.

In addition, the application sends out potentially sensitive information like the registered username, registration code and some other information in query string as a part of the update request. Since this is over an unencrypted channel this information is fully visible to the attacker.

Second Finding

A second issue I discovered is that WinZip 24 opens pop-up windows time to time when running in Trial mode. Since the content of these popups is HTML with JavaScript that is also retrieved via HTTP, it makes manipulation of that content easy for a network adjacent attacker. In the end, malicious actors can exploit this issue to execute arbitrary code as in previous scenario.

Example pop-up that fetches content over HTTP:



These findings have been through our responsible disclosure program and WinZip users can mitigate these issues by upgrading (not for free) to the latest version of WinZip (version 25 at the time of this writing). That version properly uses HTTPS and is no longer vulnerable to these sorts of attacks. Users that can’t upgrade should opt out of update checks and manually look for and verify updates.



Trustwave Advisory TWSL2020-009