[20485] in bugtraq
Re: Double clicking on innocent looking files may be dangerous
daemon@ATHENA.MIT.EDU (Elias Levy)
Fri Apr 27 11:39:54 2001
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-ID: <20010426233842.I11199@securityfocus.com>
Date: Thu, 26 Apr 2001 23:38:42 -0600
Reply-To: aleph1@SECURITYFOCUS.COM
From: Elias Levy <aleph1@SECURITYFOCUS.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
I am killing this thread.
While many have pointed out the fact that if you can place a file in
an area were a user may eventually be able to find it and open it
(e.g. by double clicking on it) the game is almost over anyway,
I feel that the most subtle point is being lost.
In the graphical user interface environment with the desktop metaphor
that most users have learned the user has been trained, whether
right or wrong, that a file's icon has some bearing on the file's type
and thus on the types of actions that are considered safe to perform
on those files.
Yet this is a false assumption. Its all too easy to change a file's
icon and choose one more innocuous.
Similarly, files that most users believe to be innocuous (e.g. a .url
or .lnk), can actually contain malicious executable content.
These problems are exacerbated by the fact that is has become all to
easy to link to networked content (e.g. UNC paths, URLs) and to map
it seamlessly into the local machine's file system space. To the point
the users can no longer distinguish between local content and remote content
and cannot make a clear determination as to what is trusted and what
is not.
Obviously part of the solution is simply user education. Another one
can be the use and extension of mechanisms such as Microsoft's Security Zones
beyond web content and applied to the file system (local and otherwise).
--
Elias Levy
SecurityFocus.com
http://www.securityfocus.com/
Si vis pacem, para bellum
