Re: [Full-disclosure] DLL hijacking with Autorun on a USB drive

[Christian Sciberras <uuf6429@xxxxxxxxx>]

See, that's where the whole industry is failing at.

There's only two kinds of files: trusted and untrusted.

Why do you say harmless? Because you know a text file can't do anything at all.
What if it was, for example an html page which when viewed would cause
a BHO to be installed, such as in a very old version of Windows?

The point of issue is not blacklisting, ie, differentiating between
what is right are wrong, but siding up with what _you_know_ is right.

In short, that innocent text file is (or at least should be
considered) as malicious as an executable.

Finally, it is not in the interest of any system to do the above
differentiation (unless it was a paranoid platform we all just love).
The security issue is comparable to running an executable directly
from a USB drive which you found....uh I'm repeating myself.
Hope you get my point of view.

Cheers.


On Wed, Sep 1, 2010 at 12:04 AM,  <paul.szabo@xxxxxxxxxxxxx> wrote:
> Christian Sciberras <uuf6429@xxxxxxxxx> wrote:
>
>> ... the user has opened the "bad" file ...
>
> The victim "views" a "data" file, does not (directly) run an executable.
> The data file could be as harmless as a Word document or a plain-text
> file.
>
> Cheers, Paul
>
> Paul Szabo   psz@xxxxxxxxxxxxxxxxx   http://www.maths.usyd.edu.au/u/psz/
> School of Mathematics and Statistics   University of Sydney    Australia
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/