9
$\begingroup$

Sources:

  1. Vulnerability Spotlight: Multiple Unpatched Vulnerabilities in Blender Identified
  2. Talos security advisory for Blender product (TALOS-2017-0451)

Secondly, I'm not asking about discussion how dangerous is it, what's the BF stance on it and other unrelated things.

There are vulnerabilities, there is possibility to use them and that's all I care about in this question.

Introduction:

If you read from sources there are some vulnerabilities regarding opening .blend files which could be prepared to do nasty stuff.

I myself had couple of times thoughts about downloading .blend files from questions/answers but it was all. Still I've downloaded them, opened them and even run scripts inside them (if the question/answer needed them).

Citing from Talos:

An attacker could weaponize these vulnerabilities and utilize social engineering tactics in conjunction with a spear phishing email to remotely exploit and compromise a targeted user. Other possible scenarios where attackers could exploit and compromise users include cases were malicious files are uploaded to sites like GitHub, Google Drive, and Dropbox for sharing with intended victims.

In our case it's even easier. Attacker can just ask question with malicious file. I don't know statistic how many of users is downloading them from Q/A. Still this could be dangerous.

I know that you can't trust anything from the internet (yet it doesn't prevent from opening every .blend file from here) but .blend files are probably for many like .jpg. It's not .exe, .vbs, or .js so it can't be harmful right? Especially when it comes from good people that are politely asking us or answering our questions. They should be good. Right?

Question:

Should we in any way try to inform users that maybe not now, maybe not in near future but .blend files can be harmful for them?

$\endgroup$
  • $\begingroup$ I always never load automatic scripts, from those files, but... Imho the reputation system could help to avoid any random user to post evil .blend files, but that will impact the chance to get an issue solved (from new users) and anyone can put another link from anywhere... or not? $\endgroup$ – m.ardito Jan 14 '18 at 8:48
  • 8
    $\begingroup$ Blend exchange does have a disclaimer on the download page noting that .blend files can contain malware. I doubt many people read it or heed it, but it's there. I'm not sure what more we can do? $\endgroup$ – gandalf3 Jan 14 '18 at 21:37
  • $\begingroup$ The preferences include an option to enable/disable Auto Run Python Scripts. My understanding was that this would protect against malicious scripts - and I always check scripts before running them. However, someone not familiar with scripting could easily enable Auto Execution and open a malicious script or run something inadvertently. The Auto Run does include Excluded Paths options and I ensure my defaults are set to exclude anything in /tmp and /home/..../Downloads/ - on the assumption that this would protect me when opening files. It is a worry though. $\endgroup$ – Rich Sedman Jan 18 '18 at 9:34
  • 4
    $\begingroup$ @RichSedman those vulnerabilities (most of them) are related to Integer Overflow Code Execution by images and videos. So any packed and prepared beforehand texture could be dangerous and we cannot block them before opening file. $\endgroup$ – cgslav Jan 18 '18 at 9:37
  • 2
    $\begingroup$ Eeek! That is a concern then. I didn’t realise that and thought the big risk was scripting. $\endgroup$ – Rich Sedman Jan 18 '18 at 9:39
  • 1
    $\begingroup$ @RichSedman adding to that, other found issues are about older .blend files (that new blender versions convert at opening, triggering buffer overflows) and also some common transform/modifier operations, even on new .blend files, trigger buffer overflows... no media and no script needed. also thumbnail preview feature can trigger those errors with "crafted" media. $\endgroup$ – m.ardito Jan 18 '18 at 11:08
  • $\begingroup$ Are we talking about the risks associated with running unknown scripts, or something else? Because with the out-of-the-box settings Blender doesn't allow you to run scripts. A user has to intentionally change the settings to enable this feature. So unless this is about some other non-script related vulnerability, this is all old news, and nothing I'd be concerned about. You might as well say "don't run suspicious Python scripts you find on the internet (including from within Blender)". $\endgroup$ – Mentalist Jan 22 '18 at 3:05
  • $\begingroup$ @Mentalist this is about issues from first two links from my question and you can also read comments here which also describing those issues. TL;DR this is about non-script related. $\endgroup$ – cgslav Jan 22 '18 at 3:08
  • 3
    $\begingroup$ Thanks for clarifying. So, I suppose we should all be a bit more cautious about what we download. It seems Blender is not the only CG software vulnerable to exploits, just more likely to be a target because of the size of its user base. From reading the developer.blender.org link it looks like developers are addressing the vulnerabilities they realistically can, but the task requires more people. Anyone care to launch a crowdfunding campaign to hire 4 more full time developers for several years to come? ;-) $\endgroup$ – Mentalist Jan 22 '18 at 3:42
4
$\begingroup$

I think the disclaimer on the blend-exchange site when downloading files should be more prominent and more strongly worded since this is a real threat. This does risk scaring people off from downloading and opening blend files but perhaps that’s no bad thing if it stops an attack.

For blend files submitted as part of a solution it’s up to the person downloading to judge whether they trust the person providing the file, judging their trustworthiness based on their answer.

For blend files submitted along with questions it’s more tricky as there’s very little effort needed for someone to post a convincing question along with a malicious blend so in that case it should be generally encouraged to post screenshots and additional info instead of just a blend - if they want people to take it seriously.

$\endgroup$
4
$\begingroup$

Link only answer.

Brecht and others have done work on fixing things.

https://www.blendernation.com/2018/01/23/blender-vulnerabilities-fixes/

but Ton's statement is worth noting:

Please note it doesn't mean Blender is anything like "safe" now. It remains important to only open Blender files from trusted sources. We still think that real and sensible security (if you want .blend files safe to be spread anonymously) is a project with a magnitude that's outside of the scope of what we can handle. For that we welcome contributions from the industry!

$\endgroup$
3
$\begingroup$

Ok, I'm going to give my opinion, simple as that. This has no weight because I'm a mod nor am I speaking for SE, BSE or blender (you get the idea).

You use blender, thus you have a computer. You are reading this, thus you have internet access. Because you have those two things we can not protect you.
End of story. (you can keep reading)

We all have known about the script dangers for years now. This "new" threat is just fresh jolt. Which should remind us all that we are downloading something from the internet, we really have no idea if it is safe.

I am of the opinion that there is no disclaimer that will help. (I mean really, look how many people download those shoddy youtube intro templates.)
Blend-exchange already has a warning, I've read it, its short and to the point:

Download this file at your own risk. It could contain viruses or other harmful material.

Yet that has not once stopped me from dowloading a file. Truthfully I don't even read it anymore. I just look at the name, size, stats and download it.

In the end here nothing has changed. You are as safe downloading a blend from one of my answers today as you were before the security advisory. (PS I will not put any malicious blends in my answers.)

Aside from all that, BSE has no built in blend hosing. So you have to go to a separate site to download a malicious file. You are 100%* safe on BSE, for that reason alone I think there is no reason to put a disclaimer on BSE.

* as safe as you can be online

$\endgroup$
2
$\begingroup$

Imho it's not the BlenderSE's job to inform about this. Answer a question about it yes, but it's a job for:

  • issuer of the software to inform (blender.org)
  • places where the files are hosted
  • Blender forums
  • news sites related to CG and Blender

There is no defense against this other than running Blender in virtual machine. I suspect only few individuals have VM's ready with Blender installs to do this, so in the end the warning does not even help fix the problem - the solution is not to avoid any .blend downloads.

The solution is to have an internet police (a bot or real people) that will scan files online and verify that they are OK (similar to verified torrent downloads). Anything else is lost effort for now.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .