Quantcast
Subscribe to magazine

Bug Hunter Claims Windows Flaw Can Hide Hazards

Can hackers trick Explorer into misrepresenting file types, disguising viruses?

Joris Evers, IDG News Service

  • 0 Yes
  • 0 No

Microsoft's Windows Explorer and Web browser Internet Explorer can be tricked into masking dangerous files as innocent ones, a security specialist says.

Hackers can exploit the flaw so unknowing PC users may run arbitrary programs, potentially ruining their systems, according to Bulgarian bug hunter Georgi Guninski, a well-known Microsoft gadfly.

By adding a certain CLSID (Class Identifier) to a file name, Windows Explorer and IE will show any file extension designated by the file's creator, instead of showing an extension that accurately reflects what kind of file it is, Guninski says. CLSIDs consist of a string of numbers between curly brackets.

A file may appear to be an innocent ".txt" (text) file, but could in fact be an "HTA" (HTML Application) file, which can run programs on a PC. The damage occurs when someone double-clicks the file to open it. The malicious file could also be portrayed as any other file type, such as various graphics formats.

Disguising a Virus

The flaw could also disguise Visual Basic Script files that contain viruses. Many recent viruses, including the far-reaching Love Letter, are VBS (Visual Basic) files. Warnings about the virus caution users to not open files with the .VBS extension--but by using a CLSID, a virus-spreader could disguise a VBS file as an apparently harmless .txt file.

Guninski said he informed Microsoft of his finding on April 11. Microsoft did not return repeated calls requesting comment.

The bug hunter rates the problem as "high risk" and suggests Windows users not double-click on files in Windows Explorer or IE.

However, there's a way to identify such a masked file, a quick test shows. Windows Explorer and IE won't associate the appropriate program icon with the file. The .txt file made by Guninski for test purposes did not carry the icon for the Windows Notepad program. Also, the file's properties--displayed by right-clicking on the file name and selecting Properties from the menu--will reveal the actual file type.

  • Recommend this story?
  • 0 Yes
    0 No
 

Deal Breakers

Special Offers for PC World Users

People who read this also read:

  • 15 Minutes to a Secure Business Get the Secure in 15 toolkit starting with the "15 Minutes Month-at-a-Glance" calendar. McAfee will send you additional tools and tricks to stay protected around the clock.
  • A Buyer's Guide to Data Protection Implementing data protection products and processes can be daunting. Make the right decisions by exploring what is available and what makes sense for your organization. Use this simple guide to evaluate different vendor offerings.

Sponsored Links