Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Filename extension illusion


14 Sep 2011   #1

Windows 7 Home premium 64 bit
 
 
Filename extension illusion

The filename below was recieved in a malicious email. It appears to have a .jpg extension but windows will run it as an application. The trick appears to be using left to right then right to left characters so the last 7 characters are "jpg.exe" backwards. I suspect this will dupe a lot of windows users.



Actual name: photo_W71765413082011_Coll*gpj.exe

Appears as:

photo_W71765413082011_Collexe.jpg

My System SpecsSystem Spec
.

14 Sep 2011   #2

MS Windows 7 Ultimate 64-bit SP1
 
 

To simulate your example, I have tried to rename one of my file to your file's first name
"photo_W71765413082011_Coll*gpj.exe"

But windows has given the error

A file name can not contain any of the following characters:
\ /:*?"<>|

The special character * is present in the file name and as such it is not possible to create or rename a file with this name.

So how that name is given to a file?
My System SpecsSystem Spec
14 Sep 2011   #3

Windows 7 Home premium 64 bit
 
 

I don't know how it's done. Probably using special unicode character. The forum replaces special characters with a *
My System SpecsSystem Spec
.


14 Sep 2011   #4

XP / Win7 x64 Pro
 
 

Windows stores file names in Unicode on disk, therefore it allows Unicode characters in file names. Unicode allows for what's called a "Right to Left Override" (RTLO), and vice versa, by putting a special set of Unicode characters in the string. In this case, the * is representing those Unicode characters because Windows explorer doesn't display Unicode. The file name on disk is photo_W71765413082011_Coll[RTLO]gpj.exe (where the RTLO code is actually 0x202E in hex) which would cause it to display as photo_W71765413082011_Collexe.jpg in Windows Explorer. If the malware author is good, they will also associate the shell extension JPG icon with it so it will even look like a non-thumbnailed jpeg in Explorer rather than the default icon Windows puts with exe's that it doesn't have a shell icon for.
My System SpecsSystem Spec
14 Sep 2011   #5

Windows 7 x64 Ultimate
 
 

Given that windows STILL installs with extensions hidden by default and 99.9999% of people never bother to change it. Does it even matter? You can actually name a file Puppy.jpg.exe and NO ONE would even know given windows default settings it would appear as "Puppy.jpg" in any folder...

(Yes, I am a bit bitter about it. For all the hoopla over security, this is still by far the biggest "hole" in windows.)
My System SpecsSystem Spec
14 Sep 2011   #6

XP / Win7 x64 Pro
 
 

This is a trick to address those who don't hide filename extensions.
My System SpecsSystem Spec
14 Sep 2011   #7

Windows 7 x64 Ultimate
 
 

Actually I won't want to downplay the severity of this particular hack as much as I'd love to ELEVATE the severity of the entire "hide extensions for known file types" "feature". It's completely a pie in the face to windows security that that even still exists let alone is the default setting for windows. :/
My System SpecsSystem Spec
15 Sep 2011   #8

MS Windows 7 Ultimate 64-bit SP1
 
 

This is something new I came to know about unicode characters in file names..... Well! learning never ends......

The RTLO unicode hole - sequence manipulation as an attack vector
My System SpecsSystem Spec
Reply

 Filename extension illusion




Thread Tools



Similar help and support threads for2: Filename extension illusion
Thread Forum
The filename or extension is too long? General Discussion
Solved Cannot remove folder - filename or extension too long General Discussion
Chrome Extension Idea - Extension Bar Browsers & Mail
Shortcut changes filename General Discussion
Nature Illusion Studio Standard Edition Software
Spinning Girl Illusion Chillout Room
Filename / Foldername cut-off General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 10:51 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33