Full Disclosure mailing list archives
Re: DLL hijacking with Autorun on a USB drive
From: Christian Sciberras <uuf6429 () gmail com>
Date: Wed, 1 Sep 2010 00:18:14 +0200
See, that's where the whole industry is failing at. There's only two kinds of files: trusted and untrusted. Why do you say harmless? Because you know a text file can't do anything at all. What if it was, for example an html page which when viewed would cause a BHO to be installed, such as in a very old version of Windows? The point of issue is not blacklisting, ie, differentiating between what is right are wrong, but siding up with what _you_know_ is right. In short, that innocent text file is (or at least should be considered) as malicious as an executable. Finally, it is not in the interest of any system to do the above differentiation (unless it was a paranoid platform we all just love). The security issue is comparable to running an executable directly from a USB drive which you found....uh I'm repeating myself. Hope you get my point of view. Cheers. On Wed, Sep 1, 2010 at 12:04 AM, <paul.szabo () sydney edu au> wrote:
Christian Sciberras <uuf6429 () gmail com> wrote:... the user has opened the "bad" file ...The victim "views" a "data" file, does not (directly) run an executable. The data file could be as harmless as a Word document or a plain-text file. Cheers, Paul Paul Szabo psz () maths usyd edu au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: DLL hijacking with Autorun on a USB drive, (continued)
- Re: DLL hijacking with Autorun on a USB drive matt (Aug 27)
- Re: DLL hijacking with Autorun on a USB drive Mario Vilas (Aug 27)
- Re: DLL hijacking with Autorun on a USB drive Charles Morris (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Christian Sciberras (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive paul . szabo (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Charles Morris (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Dan Kaminsky (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Charles Morris (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Christian Sciberras (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive paul . szabo (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Christian Sciberras (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive paul . szabo (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Valdis . Kletnieks (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Christian Sciberras (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Valdis . Kletnieks (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Christian Sciberras (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive paul . szabo (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Dan Kaminsky (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive paul . szabo (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive Dan Kaminsky (Aug 31)
- Re: DLL hijacking with Autorun on a USB drive matt (Aug 27)
- Re: DLL hijacking with Autorun on a USB drive Christian Sciberras (Aug 31)