Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In order to apply custom "visual styles" or themes in Windows 7, you must patch a few system files including Explorer.

I can see from the start how this could be a potential security problem, but how much so? Is there any confidence to be had in the fact that accusations of malicious intent don't seem prevalent?

Lastly, are there any ways to modify these files by hand to facilitate custom visual styles? Input on how safe or unsafe this may be is also welcome.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The basic problem is that in order to for Windows to be in a trusted state all of it's own files must not be tampered with.

Tampering with the file(s) on its own won't cause too much harm simply because Windows will catch the change and replace the file with a known good copy. It gets very serious however when you block the replacement, which is required if you want the visual style to stick around.

Blocking the replacement means that any other malicious activity that attempts to modify a system file will have a better chance of succeeding. In other words, you've just accomplished the task of a piece of malicious code on behalf of the malicious code.

Please don't do this.

share|improve this answer
    
I don't plan to haha, it already seemed like a security risk to begin with. Just for kicks, would manually patching and only replacing the "known good file" minimize the security impact any? –  mellowmaroon Feb 19 '13 at 16:50
    
No, because you still have to block the system file check. You can't modify the known good file. –  Steve Feb 19 '13 at 17:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.