Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening *.txt file is dangerous on Windows

technet.microsoft.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Opening *.txt file is dangerous on Windows

#11

Post by shabble »

jnorthrop wrote: post #2

Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.

A bit of digging around suggests it's a DLL preloading attack which somehow convinces the target apps to load the local directory instance of the dll, rather than the system version.

http://www.crn.com/news/security/226900204/microsoft-warns-u...

has a bit of detail, but not specifically about this attack.

I guess it's conceptually similar to doing something like

    export PATH=.:$PATH; cat foo.txt
where 'cat' is an executable file in the current dir.

The actual linux equivalent would probably involve $LD_LIBRARY_PATH ($DYLD_LIBRARY_PATH on OSX, not sure about other unices).

Re: Opening *.txt file is dangerous on Windows

#12

Post by dfranke »

bricestacey wrote: post #8
jnorthrop wrote: post #2

Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.

> this looks like it would be difficult to execute since the text file has to be in the same directory as the dll. Seems like a great way to compromise your boss' computer since so many businesses use Windows and networked file systems.

Unless you have an exceptionally paranoid workplace, a much easier way to compromise your boss's computer is just to walk over to it and pop in a livecd after he's gone home for the day.

Re: Opening *.txt file is dangerous on Windows

#13

Post by Groxx »

I wonder if this was in use (for legitimate uses) by anyone prior to its omg-security-breach discovery, and if their use still works. Quite a few Windows applications look in their folder first for DLLs - checking the loaded-file path could conceivably make the same kind of sense. Or just not accounting for current-directory changes when launching with a file (not entirely sure what the behavior is there).

Re: Opening *.txt file is dangerous on Windows

#14

Post by sp332 »

jnorthrop wrote: post #2

Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.

It's a malicious dll, not a malicious txt. It could be any txt file, as long as the dll is in the right place. So it must be something to do with the search path the program uses to look for dlls.

Re: Opening *.txt file is dangerous on Windows

#16

Post by baddox »

nollidge wrote: post #5
jnorthrop wrote: post #2

Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.

I wonder if Notepad, Wordpad, and maybe Word all call some library (or all have copy/pasted code) that, for whatever reason, looks for a particular DLL in the working folder and executes it? Not sure how the network drive part would fit into that hypothesis, though.

The article doesn't mention it, but does anyone know if a requirement to reproduce the vulnerability is that the files be opened in Notepad, Wordpad, or Word? What if you used a third-party editor?

Re: Opening *.txt file is dangerous on Windows

#17

Post by martey »

jmvoodoo wrote: post #6

So basically send someone a zip file with a DLL + readme.txt. Most people would avoid the DLL but not think twice about opening the readme. Sounds nasty.

From the "Mitigating Factors" section of CVE-2011-1991:

"For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application."

Since a ZIP file would extract to a local directory, nothing would happen.

Re: Opening *.txt file is dangerous on Windows

#19

Post by chalst »

jmvoodoo wrote: post #6

So basically send someone a zip file with a DLL + readme.txt. Most people would avoid the DLL but not think twice about opening the readme. Sounds nasty.

It depends upon the DLLs that the default application uses to show the .txt file to the user: the application has to try to install a DLL that is not in the usual places (i.e., system & windows directories and the application directories). So there is likely to be some speculative DLL lookup going on for apparently well-behaving code to be vulnerable to this.

From the description of the vulnerability, it sounds as if the culprit is some code mounting documents over the network, and so just opening a readme.txt in the local directory will not trigger this.

Post reply on HN