Re: DLL hijacking with Autorun on a USB drive

["Stefan Kanthak" <stefan.kanthak () nexgo de>]

Paul Szabo wrote:

> Christian Sciberras <uuf6429 () gmail com> wrote:
>
> > ... the user has opened the "bad" file ...
>
> The victim "views" a "data" file, does not (directly) run an executable.
> The data file could be as harmless as a Word document or a plain-text
> file.

Word (resp. MS Office) documents ain't harmless: they may contain VBA
code.
Plain text files can be harmfull too: any *.pl, *.js, *.vbs, *.reg
which gets opened^Winterpreted by its associated application, not
just viewed in the editor, can cause havoc.
And it doesn't really matter whether the user double-clicks the file,
or starts the resp. application first and opens the file from there.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/