7-Zip Exploit Leak on Twitter? Creator Debunks AI-Generated Hoax!

Recently, a user known as @NSA_Employee39 posted what they claimed was a zero-day exploit for the widely used open-source file compression tool, 7-Zip, on Twitter. This allegation was quickly refuted by 7-Zip’s developer, Igor Pavlov, who labeled the exploit as phony. The authenticity of the tweet was also doubted by others in the Twitter community, with speculations that the content might have been generated by AI, possibly using tools like ChatGPT.

The news of this supposed arbitrary code execution (ACE) flaw affecting 7-Zip spread rapidly online. The tech community and independent investigators are now left to rely on Igor Pavlov’s rebuttals to dismiss the claims of this alleged exploit.

Pavlov has taken to Sourceforge.net to clarify the situation through a number of official comments. He explained, “It appears that this alleged exploit code shared on Twitter was created by a language model (AI).” He added details about the content of the fake code, “The comment in the bogus code states: ‘This exploit aims at a flaw in the LZMA decoder of the 7-Zip software. It manipulates a crafted .7z archive with an incorrectly formed LZMA stream to induce a buffer overflow condition in the RC_NORM function.'”

Pavlov pointed out a critical inaccuracy in the claim, “However, there is no RC_NORM function in the LZMA decoder. In reality, the 7-Zip software includes an RC_NORM macro in the LZMA encoder and PPMD decoder, which means that the LZMA decoding process doesn’t even involve RC_NORM. Thus, the exploit’s assertion regarding RC_NORM is simply untrue.”

Given that 7-Zip is open-source software, the community support for Igor’s dismissal of the claim is stronger than the unverified assertions of an alleged NSA employee. This situation suggests that there isn’t a genuine concern for end-users about this reported vulnerability.

For those who remain cautious, it’s advised to run security scans on any unfamiliar files compatible with 7-Zip that you might download. The described exploit would still require someone to open a compromised file manually. Ultimately, credible sources affirm that the reported exploit is fictitious, with indicators suggesting it was concocted by an AI rather than a legitimate cybersecurity threat actor. It’s a disappointing revelation about the misuse of AI in cybersecurity misinformation.