full-disclosure - Re: DLL hijacking with Autorun on a USB drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4AF55C28B6664AC59358D525E10703EE@localhost>
Date: Wed, 15 Sep 2010 00:24:30 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <paul.szabo@...ney.edu.au>,
	<cmorris@...odu.edu>,
	<uuf6429@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: DLL hijacking with Autorun on a USB drive

Paul Szabo wrote:

> Christian Sciberras <uuf6429@...il.com> wrote:
> 
>> ... the user has opened the "bad" file ...
> 
> The victim "views" a "data" file, does not (directly) run an executable.
> The data file could be as harmless as a Word document or a plain-text
> file.

Word (resp. MS Office) documents ain't harmless: they may contain VBA
code.
Plain text files can be harmfull too: any *.pl, *.js, *.vbs, *.reg
which gets opened^Winterpreted by its associated application, not
just viewed in the editor, can cause havoc.
And it doesn't really matter whether the user double-clicks the file,
or starts the resp. application first and opens the file from there.

Stefan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/