Wednesday, March 12, 2008

Potentially dangerous filetypes

First of all: why potentially? Because these filetypes are common on a tipical system and some of you may already know this, some of you don't but not all file types can pose a threat to your system, and even those that can, are most usually clean (in fact vast majority of them are needed for proper system operation). File types that can potentially pose a threat to your system are the ones which contain executable code, or some metadata that involves internet.

So you have two groups:
  1. System executable code
  2. Some scripting language code or metadata information
Group one: system executable code
File types in this group are the ones containing machine code, system executes these at its lowest level by basically loading them in the memory and jumping to the first instruction. These file types pose greatest threat because they are limited only by the creativity of the malicious user who wrote them. There are basically three things a malicious program in this group can do to ensure its loading every time:
  • Infect other files of the same type
  • Overwrite some system file which gets run every time, with its own code
  • Install itself in some system folder under some obscure filename and use system registry so that OS can run it automatically on every boot up
First option is most commonly used by viruses and can be most destructive. Here is how the infection gets done:
first the virus appends its own code to some executable file, when user tries to run such file the virus temporarily disinfects that file so that it can be run normally and prevent user from becoming suspicious. When user quits the program it gets infected again. When you receive infected file its enough just to run it and voila you're infected.
Please note that you can theoretically have infected file sitting on your hard drive and not get yourself infected but if and only if you don't run it. I delete such files with DOS "del" command (usage "del ") and not from windows because i don't trust windows when clicking on infected files. Note that in win2000 and later instead of dos you have CMD which emulates dos.
Other two option are mostly used by worms and trojans because they're much simpler. You can easily remove them all by yourself if you can find them (first you need to kill their process because windows does not allow deleting program files which are currently running)
Most common extensions of files in this group are: .exe, .dll, .ocx, .sys, .bin, .vxd, .com

Group two: Scripting language code and metadata
Files in this group cannot be run on their own, they depend on other apps to run interpret their code and as such they pose no threat when not opened in their appropriate application. Malicious files of this group always use some exploit in application that runs them to achieve their goals.
Most common representatives of scripting files are javascript and visual basic script which are reliant on web browser to execute them (because they're used combined with html pages to make websites more interactive)
Other representative of script files are MS office macros which, as you can already tell, can only harm you if you have MS office installed and damage they can do is limited to your office documents not the entire system.

And lastly you have various metadata exploits within some popular media types (most commonly quicktime, windows media video, and windows media audio) these can contain links that automatically takes you to some malicious website or something similar. Such files are generally spread across P2P networks.
For example you search for "Billy Idol - white wedding" which is 3+ minutes song, and among results you get something like "Billy Idol - white wedding 1.0 full crack" which is like 400kb in size. Do not meddle with these, if you're suspicious of some file use .mp3 instead, they cannot contain any malicious tags.
Most common extensions of files in this group are: .js, .jar, .vbs, .qt, .mov, .wmv, .wma, .asf

0 comments:

Counting the masses