Re: [Full-disclosure] DLL hijacking with Autorun on a USB drive



See, that's where the whole industry is failing at.

There's only two kinds of files: trusted and untrusted.

Why do you say harmless? Because you know a text file can't do anything at all.
What if it was, for example an html page which when viewed would cause
a BHO to be installed, such as in a very old version of Windows?

The point of issue is not blacklisting, ie, differentiating between
what is right are wrong, but siding up with what _you_know_ is right.

In short, that innocent text file is (or at least should be
considered) as malicious as an executable.

Finally, it is not in the interest of any system to do the above
differentiation (unless it was a paranoid platform we all just love).
The security issue is comparable to running an executable directly
from a USB drive which you found....uh I'm repeating myself.
Hope you get my point of view.

Cheers.


On Wed, Sep 1, 2010 at 12:04 AM, <paul.szabo@xxxxxxxxxxxxx> wrote:
Christian Sciberras <uuf6429@xxxxxxxxx> wrote:

... the user has opened the "bad" file ...

The victim "views" a "data" file, does not (directly) run an executable.
The data file could be as harmless as a Word document or a plain-text
file.

Cheers, Paul

Paul Szabo   psz@xxxxxxxxxxxxxxxxx   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: USA Rugby job
    ... He was mostly harmless. ... come;-)   In fact, they're all the same as far as I'm concerned ... way Thatcher was to just about everybody. ...
    (rec.sport.rugby.union)
  • Re: Fake Irish Mike at American Land and Minerals
    ... ok to try to contact their employer to get them fired? ...   its just ... harmless little internet hijinks. ...
    (rec.gambling.poker)
  • Re: Lock order reversal .
    ...    The mount LOR is well known. ... Do we have the possibility of silencing well-known and presumably harmless LOR's if there isn't sufficient motivation to fix the source? ...
    (freebsd-current)
  • Re: Garden Terror!
    ... then realised the offending object was quite harmless. ... Anyone recognise it;-)? ...   DavidinNorma...@xxxxxxxx ...
    (uk.rec.gardening)