Windows 7 RC ignores file extension security risk
No change in the design that lets hackers easily mask malicious files
May 6, 2009 12:00 PM ETWindows 7
- Windows 7 on track for August RTM, October sales
- Windows 7 RC's 'free' reign to end with auto-shutdowns
- Microsoft patches huge Windows 7 RC bug
- Microsoft releases free beta for Windows 7 upgrade advisor
- Speed Test: Windows 7 RC not much faster than Vista
- Microsoft dumps 'WGA' name, keeps anti-piracy tech in Windows 7
- Windows 7 RC ignores file extension security risk
- Review: Windows 7 RC1 adds speed, UI improvements
Computerworld - Windows 7 Release Candidate (RC) continues a long-running Microsoft practice that puts users at risk, a security researcher said today.
The new operating system's Windows Explorer file manager still misleads users about the true extension of a file, said Patrik Runald, chief research advisor at Helsinki-based F-Secure Corp. Rather than reveal the full extension for a filename, Windows Explorer hides the extension for known file types, giving hackers a way to disguise malware by using those file types' extensions and icons.
Windows Explorer, for example, will show the .txt icon and display "attack.txt" as the filename for a Trojan horse that's actually been named "attack.txt.exe" by the hacker. The practice goes back to at least Windows NT, and has been criticized in the still-popular Windows XP and the newer Windows Vista.
"People typically look at the icon to know what the file is," said Runald. "If it looks like a Word doc or a PDF file, there's an implicit trust in it, and users are more likely to click on those files, even if they are actually an executable."
Windows, Runald continued, is smart enough to know the true nature of the file, and will, for instance, run an .exe even if the filename shows as "attack.txt" in Explorer.
"This has been used for years by virus writers -- maybe less than it used to be, since most attacks now are drive-by downloads [using browser vulnerabilities], and not e-mail attachments," Runald noted. "But you still see it."
Microsoft should show the true filename in Explorer, urged Runald. "Bottom line, it's a still bad idea not to."
Windows 7 RC launched yesterday, and will be available for download until at least through the end of July.
Read more about security in Computerworld's Security Knowledge Center.
Microsoft
Additional Resources



White Papers & Webcasts
Oracle Accelerate - Not Just Smart but Timely
Download Now!
Data in Action: Making the Planet Smarter
Register Now
Why BI is Ripe - Now! - For Businesses of Any Size
Download Now!
The Workday User Experience Video
Watch Workday's Creative Director, Scott Lietzke, discuss the business-centered design philosophy at Workday.
Rapid Implementation: The New Age of ERP
Download Now!
Business Process Framework Demo
Learn about Configurable Business Processes and Calculated Fields. Watch Now!
Manager Experience Demo
Go beyond self-service solutions to perform more effectively. Watch Now.


