Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Filename extension illusion

14 Sep 2011   #1
iamdd

Windows 7 Home premium 64 bit
 
 
Filename extension illusion

The filename below was recieved in a malicious email. It appears to have a .jpg extension but windows will run it as an application. The trick appears to be using left to right then right to left characters so the last 7 characters are "jpg.exe" backwards. I suspect this will dupe a lot of windows users.



Actual name: photo_W71765413082011_Coll*gpj.exe

Appears as:

photo_W71765413082011_Collexe.jpg


My System SpecsSystem Spec
14 Sep 2011   #2
rraod

MS Windows 7 Ultimate 64-bit SP1
 
 

To simulate your example, I have tried to rename one of my file to your file's first name
"photo_W71765413082011_Coll*gpj.exe"

But windows has given the error

A file name can not contain any of the following characters:
\ /:*?"<>|

The special character * is present in the file name and as such it is not possible to create or rename a file with this name.

So how that name is given to a file?
My System SpecsSystem Spec
14 Sep 2011   #3
iamdd

Windows 7 Home premium 64 bit
 
 

I don't know how it's done. Probably using special unicode character. The forum replaces special characters with a *
My System SpecsSystem Spec
14 Sep 2011   #4
FliGi7

XP / Win7 x64 Pro
 
 

Windows stores file names in Unicode on disk, therefore it allows Unicode characters in file names. Unicode allows for what's called a "Right to Left Override" (RTLO), and vice versa, by putting a special set of Unicode characters in the string. In this case, the * is representing those Unicode characters because Windows explorer doesn't display Unicode. The file name on disk is photo_W71765413082011_Coll[RTLO]gpj.exe (where the RTLO code is actually 0x202E in hex) which would cause it to display as photo_W71765413082011_Collexe.jpg in Windows Explorer. If the malware author is good, they will also associate the shell extension JPG icon with it so it will even look like a non-thumbnailed jpeg in Explorer rather than the default icon Windows puts with exe's that it doesn't have a shell icon for.
My System SpecsSystem Spec
14 Sep 2011   #5
fseal

Windows 7 x64 Ultimate
 
 

Given that windows STILL installs with extensions hidden by default and 99.9999% of people never bother to change it. Does it even matter? You can actually name a file Puppy.jpg.exe and NO ONE would even know given windows default settings it would appear as "Puppy.jpg" in any folder...

(Yes, I am a bit bitter about it. For all the hoopla over security, this is still by far the biggest "hole" in windows.)
My System SpecsSystem Spec
14 Sep 2011   #6
FliGi7

XP / Win7 x64 Pro
 
 

This is a trick to address those who don't hide filename extensions.
My System SpecsSystem Spec
14 Sep 2011   #7
fseal

Windows 7 x64 Ultimate
 
 

Actually I won't want to downplay the severity of this particular hack as much as I'd love to ELEVATE the severity of the entire "hide extensions for known file types" "feature". It's completely a pie in the face to windows security that that even still exists let alone is the default setting for windows. :/
My System SpecsSystem Spec
15 Sep 2011   #8
rraod

MS Windows 7 Ultimate 64-bit SP1
 
 

This is something new I came to know about unicode characters in file names..... Well! learning never ends......

The RTLO unicode hole - sequence manipulation as an attack vector
My System SpecsSystem Spec
Reply

 Filename extension illusion




Thread Tools





Similar help and support threads
Thread Forum
The filename or extension is too long?
I'm trying to delete something I recovered off the HD, and now I can't delete it. I can't rename, delete, cut, copy, anything. I've seen people say do it from CLI like abbreviating such as "del filename~1.txt" or whatever t he extension is... but even that gives the error saying its too long....
General Discussion
Cannot remove folder - filename or extension too long
This happened on a Windows XP SP3 32-bit computer. I am trying to delete the backup files created by the Memeo program that comes with Seagate GoFlex Home NAS. I selected the root folder of the backup files and pressed delete, which started the deletion process of some 30 GB sized backup. After the...
General Discussion
Chrome Extension Idea - Extension Bar
I got a idea for a Chrome extension, but no where to request it. When you install extensions in Chrome it places all the extensions to the right side of the address bar. My idea is to have a extension bar below the bookmark bar that automatically hides it's self when the mouse isn't hovering...
Browsers & Mail
Shortcut changes filename
Windows 7 Enterprise, SP1 Created a shortcut to open MS Access 2003 that worked. Now that I have been upgraded to Windows 7 and Access 2010, I updated my shortcut. It's a long shortcut and I have shortened it below. "C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE"...
General Discussion
Spinning Girl Illusion
Ok everyone, I don't know how many of you have ever checked out this site before but I would like to do a poll on the spinning girl illusion they have on there. I see her spin counter clockwise and my wife and 2 daughters have me wondering if I am crazy. So if you all will do this for fun lets...
Chillout Room
Filename / Foldername cut-off
http://img2.pict.com/9b/15/e0/1373139/0/800/123.jpg http://img2.pict.com/47/68/45/1373162/0/123.jpg see the file/folder names are cut off. when its selected, that time also, its showing the same.... how to resolve it.... i want to display full name when i select it like normal appearance....
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 01:57.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App