Opening *.txt file is dangerous on Windows
technet.microsoft.com
Opening *.txt file is dangerous on Windows
1–10 of 52 posts
Re: Opening *.txt file is dangerous on Windows
#2Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
Re: Opening *.txt file is dangerous on Windows
#3Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
Doesn't sound too difficult if you're sending someone an archive with both files in it.
Re: Opening *.txt file is dangerous on Windows
#4Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
Yeah, it has to be "an untrusted remote file system location."
Re: Opening *.txt file is dangerous on Windows
#5Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
I wonder if Notepad, Wordpad, and maybe Word all call some library (or all have copy/pasted code) that, for whatever reason, looks for a particular DLL in the working folder and executes it?
Not sure how the network drive part would fit into that hypothesis, though.
Re: Opening *.txt file is dangerous on Windows
#6So basically send someone a zip file with a DLL + readme.txt. Most people would avoid the DLL but not think twice about opening the readme. Sounds nasty.
Re: Opening *.txt file is dangerous on Windows
#7[deleted]
Re: Opening *.txt file is dangerous on Windows
#8Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
> this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
Seems like a great way to compromise your boss' computer since so many businesses use Windows and networked file systems.
Re: Opening *.txt file is dangerous on Windows
#9Anyone know how this works? How would a plain .txt file load a dll? In any case this looks like it would be difficult to execute since the text file has to be in the same directory as the dll.
I wonder if Notepad, Wordpad, and maybe Word all call some library (or all have copy/pasted code) that, for whatever reason, looks for a particular DLL in the working folder and executes it? Not sure how the network drive part would fit into that hypothesis, though.
Windows suffers some famous dain bramage wrt to DLL loading paths: http://unhandledexpression.com/2010/08/23/fixing-the-dll-loa... Basically, even when "safe" DLL loading is turned on, the search path still includes the current directory. I'm guessing that Notepad and friends all look for some (legacy?) DLL that isn't always installed, so if an attacker puts a malicious DLL by its same name in the same path as the file being opened, it'll be loaded and executed. The part about network drives is probably just an assumption about trust boundaries: Microsoft assumes that attacker can't ordinarily put a malicious file in the same local folder that you're opening a text file in, but on a network drive anything goes.
This is all just speculation. I don't code for Windows, and I don't know anything more about this vulnerability than what's stated in the advisory.
Re: Opening *.txt file is dangerous on Windows
#10I wonder if this is still an issue when using a 3rd party editor, such as EditPad, etc.