full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 1 Sep 2010 00:18:14 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: paul.szabo@...ney.edu.au
Cc: full-disclosure@...ts.grok.org.uk, cmorris@...odu.edu
Subject: Re: DLL hijacking with Autorun on a USB drive

See, that's where the whole industry is failing at.

There's only two kinds of files: trusted and untrusted.

Why do you say harmless? Because you know a text file can't do anything at all.
What if it was, for example an html page which when viewed would cause
a BHO to be installed, such as in a very old version of Windows?

The point of issue is not blacklisting, ie, differentiating between
what is right are wrong, but siding up with what _you_know_ is right.

In short, that innocent text file is (or at least should be
considered) as malicious as an executable.

Finally, it is not in the interest of any system to do the above
differentiation (unless it was a paranoid platform we all just love).
The security issue is comparable to running an executable directly
from a USB drive which you found....uh I'm repeating myself.
Hope you get my point of view.

Cheers.

On Wed, Sep 1, 2010 at 12:04 AM,  <paul.szabo@...ney.edu.au> wrote:
> Christian Sciberras <uuf6429@...il.com> wrote:
>
>> ... the user has opened the "bad" file ...
>
> The victim "views" a "data" file, does not (directly) run an executable.
> The data file could be as harmless as a Word document or a plain-text
> file.
>
> Cheers, Paul
>
> Paul Szabo   psz@...hs.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
> School of Mathematics and Statistics   University of Sydney    Australia
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/