Slashdot Mirror
Windows 7 Users Warned Over Filename Security Risk
nandemoari writes "Would-be Windows 7 users have been warned to change a default setting which could leave them vulnerable to attack via bogus files. As a result, Microsoft is taking flak for failing to correct a problem found in previous editions of Windows.
The issue involves the way Windows Explorer displays filenames.
In all editions of Windows after Windows 98, the default setting hides the filename extension (which identifies what type of file it is). This means that a Word file titled 'partyinvite.doc' will show up in Windows Explorer as simply 'partyinvite'. The only exception to this rule is if Windows does not recognize the file type.
The reason for this setting is that it makes for a less cluttered look and avoids filling the screen with redundant detail. However, a flaw in the way it works leaves it liable to exploitation by hackers. They can take an executable file (which can do much more damage to a computer when opened) and disguise it by calling it 'partyinvite.doc.exe.'"
How can this possibly be? I thought this was the most secure OS on the planet.
it shouldn't be made executable by the default umask though, so when you go to click on it it'll just try to associate an application with the .exe extension.
Paying taxes to buy civilization is like paying a hooker to buy love.
This is a non-issue. With all of the vulnerabilities in applications that think they are a programming interface (like Acrobat), EXE's might actually be safer to open.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
or any of the others that make you jump through hoops to get at something.
1. Partial menus (Office)
2. The Search Dog (Windows XP)
3. I don't what else but the way they have features turned off and on makes no sense at all.
The I'm done sig.
Most people wouldn't change their behaviour even if the did see the file extension.
Email programs such as Outlook block .exe attachments, and Executables downloaded using IE display a stern warning before execution.
Changing this wouldn't have helped anyone.
And associating this with Windows 7 is mostly FUD, jumping on the bandwagon just because you don't like it.
Welcome to Windows 95?!
Filename extensions have been hidden by default for many years now, in all shipping versions of Windows. And they've been making it easy for malware authors to fool users for just as long.
It was an insanely stupid policy on MS's part, and it borders on negligence that they're still doing it.
You can easily add the Word icon to your malware, and this will fool users easily.
OSX hides extensions, too, and what's arguably worse, OSX allows you to arbitrarily replace the icon of any file, thereby allowing you to disguise files more easily. Don't some Linux DEs do the same thing?
It's sort of unfortunate that we rely on filename extensions to identify file type at all. Users have a tendency to accidentally remove extensions when they're renaming if you don't hide them. But then if you hide them, then users are missing the single most important cue as to what file-type a file is.
Only if the creator is stupid. All it takes is to get an icon from a doc and use that icon as the default icon resource within the exe file, and voilà - not only it seems to be named .doc, it looks like a word file, too.
The only correct solution is stop trying to hide information from users: showing extensions should be the only acceptable alternative. Hiding them could make sense before, but since Vista even the UI is correct: you click on a filename to edit it and only the non-extension part is selected by default.
many years ago when i was using win98 i would always set folder options to NOT hide file extensions and it still hides that second extension, i had what looked like an ordinary bitmap file file_name.bmp but i clicked on it to open it and bam! its true colors show up and it disappears completely even with show all files enabled (file_name.bmp.js) shows for a second and its gone, so i fdisk windows off and reinstall since anti-virus did not find anything and that looked too fishy to be innocent, that taught me no not click on a file to open it, always open a graphics editor/viewer and use file > open to open them then if something is wrong the graphics app will complain if something is wrong with the file.
Politics is Treachery, Religion is Brainwashing
Now, I'll go make a quick patch and submit the .diff
I wonder if ReactOS, the project to make a free Windows XP clone, might take it.
UAC doesn't really come that much into play here. It's still possible to capture all your credit card data without elevating to admin.
That said, Explorer blocks execution of files downloaded from the Internet, and Outlook blocks executable attachments completely.
Do we really think that it's going to make a difference to Joe Schmoe? If it has a Word document icon, our hapless friend is going to be duped regardless of whether it ends in ".doc" or ".doc.exe".
May I remind you that, with file extensions hidden by default, ONE SHOULD NEVER SEE A FILE ENTITLED "partyinvite.doc", because that extension should be hidden. The fact that it isn't hidden is already a glaring red flag — which Joe Schmoe is obviously oblivious to.
I turn extensions on by default, but I really don't think that would help Mr. Clueless. Somebody needs to sit him down and explain to him what's going on, and nothing is going to save him from the trouble of paying the proper attention to the files he opens.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Here's the thing: UAC is one layer of defense against this (even though UAC is never called a protective layer, it seems). If there is no verified publisher, UAC will say that the publisher is unknown and thus, in theory, it should trigger a red flag with people. That's how all of my computer illiterate friends approach it, and they've never had problems.
Heck, just about all legitimate programs I download from a non-major publisher says that the publisher is unknown. About the only programs that I have installed with a "known" publisher are Firefox, and iTunes. The rest still say unknown publisher.
Taxation is legalized theft, no more, no less.
The filename should not contain any metadata. The date is not included in the filename, so why is the filetype in there?
If less clutter was the design goal, MS could have started somewhere else. Like the explorer toolbar (just leave the up, back, and forward buttons thank you), the "Go" button beside the address bar, the big explorer sidebar with the many superfluous items, the cluttered search side bar, the pointless icon view, i could go on. They could probably even drop the whole Start menu paradigm and move to right-click on desktop to display the start menu contents, leaving the whole taskbar for application tabs.
Users have a tendency to accidentally remove extensions when they're renaming if you don't hide them.
That's why a good file manager, like the version of Nautilus that comes with Ubuntu Hardy, selects everything before the extension when the user chooses "Rename".
As an Apple fan-boy, I am chagrined to have to point out that there is an analogue of this problem on OS X. Meta information about a file will contain information about its "Creator" (which is often used to determine what application it should be opened with) and also the file Icon.
This allows for a file to have, say a plain text icon but open as something else altogether. Apple has taken some mitigating steps (warnings before executing downloaded files for the first time), but has not changed the underlying problem which stems from concealing information from the user.
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
Plus both have lower total cost of ownership.
[citation needed]
Seriously. It's not like I paid for my A/V software. It's not like I run scans when I'm using the system, so my work isn't being slowed.
Then, vs. just OSX, the hardware's cheaper, you can upgrade it and futureproof it, so you don't need to buy an entirely new $1.5k machine, and software's same price or cheaper, with more options. And as for security, may I point you to the Mac-only botnet that was recently discovered due to pirated copies of iLife, or iWork, or whatever it was? Stupid people will fuck up any system you give them, regardless of OS. Windows is not inherently superior or inferior, it's just the one that does what I need.
Canada: The US's more awesome sibling.
You want a solution? How about this: Windows should only hide file extensions for files that don't use custom icons
How about we never hide the extension for any reason? If you're worried about clutter, and redundant information on screen, ditch the icons. The extension is all of 3 bytes, and it's far, far easier to read 3 letters than it is to squint at the icon and guess what it's supposed to be.
Give me Classic Slashdot or give me death!
Then this is the time to make a big fuss about it: so that it will be fixed for Win7.
http://rocknerd.co.uk
How can this possibly be?
Your question actually has a face value in excess of it's sarcasm content. How did we get here?
I'm stating common knowledge but it's worth reflection since it paints a large picture. In the begining there was the file and the file was just a marked off stretch of physically contiguous bytes on a tape or drum. it had no internal structure. Have a directory that associated names with files regions was something you had to implement yourself. The filesystems formalized this to having names, hierarchies, and even non-contiguous allocation tables for blocks.
Since that time every new file system has tried to codify the notion of metadata. And in this land of babble, the only common durable hiding place for meta data has turned out to be the filename itself.
Look at HFS for example as a valiant effort in defining meta data like "kind" and "creator", and defining different kinds of forks some of which had uniform storage protocols for resource, so that programs other than the creator could inspect and edit them. And boy what a snarl that has perpertually been. While these still exist, apple has punted and gone to just using file structures and a specially named file (plists) to hold meta data in a quasi XML format.
And so here we are 30 years later and were still putting suffixes on our files just like back in the days of DEC and Prime and even before.
And think about perhaps the biggest failure of the Longhorn Debacle. The promise of a revolutionary new filesystem that put meta data and it's inspection first. An entirely relational storage system underneath that only mimmiced the hierachical system for legacy purposes.
Deleted from Longhorn, promised again for vista, and then gone. Promised for windows 7 then gone.
It's bizzare. Everyone knows what the problem is. HFS was much maligned precisely because it was more complex than suffixes but it's what we really needed back in 1984. and all the others all made so much sense too.
Why are suffixes so enduring? How can this be?
Some drink at the fountain of knowledge. Others just gargle.
Run virus.exe in XP (SP2), Vista, or (I presume) 7.
What's that box? A security warning about unsigned code?
Rename the file to virus.txt.exe and try again.
What's that box? A security warning about unsigned code?
Fuck off insecurity experts.
It doesn't seem to me that line-bundle was particularly blaming Bill Gates, Windows, or Microsoft. Using extensions in filename as the identifier of file-type is a common and long-standing practice, but it's also problematic.
Upon reading this, I wondered whether MacOS X suffered the same issue, so I decided to test. I disabled the showing of all extensions (Finder preferences), duplicated Text Edit, so it appeared as "TextEdit 2" and then edited the visible name to "TextEdit 2.doc". The result was displaying itself as "TextEdit 2.doc.app". For other file types, such as a PDF doing the same thing results in being asked if you are sure you want to change the filename extension, though renaming from the Terminal a PDF from "toto.pdf" to "toto.doc.pdf" resulted in the same visual behaviour as the one observed for the application. Its an interesting solution to the problem, since basically if the file has multiple extensions they are all shown.
The issue described in the post has already caused me issues in the past on Windows XP, on a developer's machine, where extensions were not shown by default. Imagine an Apache conf folder that contains:
http.conf
http.conf.bak
The first one appears as 'http' and the second one as 'httpd.conf'. I didn't hit me straight away that the wrong file was being edited.
Does anyone know how Linux handles this in the various GUI file managers?
Jumpstart the tartan drive.
why do they keep burying the windows explorer
You can always hit "Windows Key + E" to get Windows Explorer. Ironically, for reasons that are simply a quirk in my brain, I mentally say "Apple+E" every time I hit those keys...
This issue is a bit more complicated than you think.
Vista fixed this. Now, when you rename a file, it highlights everything except the extension, so when you start typing, the extension isn't overwritten.
So, this is no longer a valid excuse for extensions being hidden by default.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
How is knowing what kind of file is going into your computer redundant?
What kind of gas is that you're putting in your car? 92? 87? LEADED? It's redundant!
What kind of batteries are you putting into that device? 9 volt? AA? It's redundant!
There's no way a user would actually want to know want they're clicking on, right Microsoft?
The eternal struggle of good vs. evil begins within one's self.
...another Windows bug I ran into the other day with how the IE engine deals with URLs.
Given the following URL (with the server properly responding with mime-type of octet-stream and an otherwise proper response):
... IE decides that since it doesn't know what a ".exe?query=string" extension is, so it strips the "extension off" and tries to connect to:
... which (in my case) doesn't exist.
http://www.somedomain.com/url/path/to/file.exe?query=string
http://www.somedomain.com/url/path/to/file
This is another example of why injecting proprietary meaning, which often contradicts with more fundamental established protocols, into processes/protocols is problematic.
Faith is a willingness to accept something w/o complete proof and to act on it. Reason allows you to correct that faith.
F-Secure points out that .PIF files will have their extension hidden even if you change the display option.
Repton.
They say that only an experienced wizard can do the tengu shuffle.
This has got to be one of the dumber anti-Windows trolls presented as news I've seen in a while. An evil hacker could also put a post-it note on an idiot's computer telling them to type "FORMAT C:" at a command prompt. People too dumb to recognize icons or use AV software just shouldn't be using computers.
That all said, I've always thought that extension hiding default was one of the more annoying things I have to kill every time I install Windoze. Seems like Redmond just keeps dumbing down the interface, forcing me to work harder at getting the details I need.
Ask me about my sig!