Timeline for How does the "ClaimLetter#.zip" attack work?
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 19, 2022 at 16:54 | comment | added | Steffen Ullrich | "and possibly runs some autostart file" - that's not what I said. Also, someone clicks on the ISO so that it will open. And the someone will click on the file inside the opened ISO container, same as someone clicks on a file opened within WinZip or similar. | |
| Sep 19, 2022 at 16:40 | comment | added | Gunther Schadow | @SteffenUllrich, so if Windows just opens .iso files, and possibly runs some autostart file, then that might be the vulnerability here. Someone needs to unpack it and then click on it. | |
| Sep 15, 2022 at 13:43 | comment | added | Steffen Ullrich | Sorry that I misunderstand this. It is actually pretty common that this is an ISO file since Windows will simply open it - it just another kind of archive format. | |
| Sep 15, 2022 at 13:06 | comment | added | Gunther Schadow | @SteffenUllrich if you look again at what I wrote and what I showed, you see that I am not so stupid to believe an ISO file is a ZIP file. I said I extracted that .iso file from the ZIP file and then wanted to look at its content with hexdump. Because I doubt this is an actual ISO file. | |
| Sep 15, 2022 at 12:42 | comment | added | Steffen Ullrich | "I felt secure enough to try to extract this .iso file with cygwin unzip" - an ISO file is a cdrom image, not a ZIP file. You cannot unpack it with unzip. For me this looks like a generic malware (likely) inside archive (ISO) inside archive (ZIP) - nothing special about this and not specific vulnerabilities to exploit to make this working. The main vulnerability here is the user which opens all this stuff since the mail sounded important. | |
| Sep 15, 2022 at 12:34 | history | edited | Gunther Schadow | CC BY-SA 4.0 |
added 886 characters in body
|
| S Sep 15, 2022 at 12:13 | review | First questions | |||
| Sep 15, 2022 at 12:41 | |||||
| S Sep 15, 2022 at 12:13 | history | asked | Gunther Schadow | CC BY-SA 4.0 |