Should we inform users about Multiple Vulnerabilities in Blender?

Question

Sources:

1. Vulnerability Spotlight: Multiple Unpatched Vulnerabilities in Blender Identified
2. Talos security advisory for Blender product (TALOS-2017-0451)

Secondly, I'm not asking about discussion how dangerous is it, what's the BF stance on it and other unrelated things.

There are vulnerabilities, there is possibility to use them and that's all I care about in this question.

Introduction:

If you read from sources there are some vulnerabilities regarding opening .blend files which could be prepared to do nasty stuff.

I myself had couple of times thoughts about downloading .blend files from questions/answers but it was all. Still I've downloaded them, opened them and even run scripts inside them (if the question/answer needed them).

Citing from Talos:

An attacker could weaponize these vulnerabilities and utilize social engineering tactics in conjunction with a spear phishing email to remotely exploit and compromise a targeted user. Other possible scenarios where attackers could exploit and compromise users include cases were malicious files are uploaded to sites like GitHub, Google Drive, and Dropbox for sharing with intended victims.

In our case it's even easier. Attacker can just ask question with malicious file. I don't know statistic how many of users is downloading them from Q/A. Still this could be dangerous.

I know that you can't trust anything from the internet (yet it doesn't prevent from opening every .blend file from here) but .blend files are probably for many like .jpg. It's not .exe, .vbs, or .js so it can't be harmful right? Especially when it comes from good people that are politely asking us or answering our questions. They should be good. Right?

Question:

Should we in any way try to inform users that maybe not now, maybe not in near future but .blend files can be harmful for them?

Answer 1

I think the disclaimer on the blend-exchange site when downloading files should be more prominent and more strongly worded since this is a real threat. This does risk scaring people off from downloading and opening blend files but perhaps that’s no bad thing if it stops an attack.

For blend files submitted as part of a solution it’s up to the person downloading to judge whether they trust the person providing the file, judging their trustworthiness based on their answer.

For blend files submitted along with questions it’s more tricky as there’s very little effort needed for someone to post a convincing question along with a malicious blend so in that case it should be generally encouraged to post screenshots and additional info instead of just a blend - if they want people to take it seriously.

Answer 2

Link only answer.

Brecht and others have done work on fixing things.

https://www.blendernation.com/2018/01/23/blender-vulnerabilities-fixes/

but Ton's statement is worth noting:

Please note it doesn't mean Blender is anything like "safe" now. It remains important to only open Blender files from trusted sources. We still think that real and sensible security (if you want .blend files safe to be spread anonymously) is a project with a magnitude that's outside of the scope of what we can handle. For that we welcome contributions from the industry!

Answer 3

Ok, I'm going to give my opinion, simple as that. This has no weight because I'm a mod nor am I speaking for SE, BSE or blender (you get the idea).

You use blender, thus you have a computer. You are reading this, thus you have internet access. Because you have those two things we can not protect you.
End of story. (you can keep reading)

We all have known about the script dangers for years now. This "new" threat is just fresh jolt. Which should remind us all that we are downloading something from the internet, we really have no idea if it is safe.

I am of the opinion that there is no disclaimer that will help. (I mean really, look how many people download those shoddy youtube intro templates.)
Blend-exchange already has a warning, I've read it, its short and to the point:

Download this file at your own risk. It could contain viruses or other harmful material.

Yet that has not once stopped me from dowloading a file. Truthfully I don't even read it anymore. I just look at the name, size, stats and download it.

In the end here nothing has changed. You are as safe downloading a blend from one of my answers today as you were before the security advisory. (PS I will not put any malicious blends in my .)

Aside from all that, BSE has no built in blend hosing. So you have to go to a separate site to download a malicious file. You are 100%* safe on BSE, for that reason alone I think there is no reason to put a disclaimer on BSE.

_{* as safe as you can be online}

Answer 4

Imho it's not the BlenderSE's job to inform about this. Answer a question about it yes, but it's a job for:

• issuer of the software to inform (blender.org)
• places where the files are hosted
• Blender forums
• news sites related to CG and Blender

There is no defense against this other than running Blender in virtual machine. I suspect only few individuals have VM's ready with Blender installs to do this, so in the end the warning does not even help fix the problem - the solution is not to avoid any .blend downloads.

The solution is to have an internet police (a bot or real people) that will scan files online and verify that they are OK (similar to verified torrent downloads). Anything else is lost effort for now.