Several Windows apps come in both "installer" and "portable" forms, with the latter having the advantage that you can just download and run it from anywhere in the system.

Doesn't being able to run them from anywhere in the system mean that such apps are inherently vulnerable to binary planting since an attacker with access to your system could at some point swap the downloaded app with a malicious executable? Isn't running code from anywhere but C:\Program Files, etc inherently dangerous? If it is, why don't we see this kind of attack all the time?


5 Answers 5


The logic behind the question is confusing, which is why I think you are having trouble getting answers or getting people to understand you.

Portable apps would be inherently subject to (I would not use the term "vulnerable to") being swapped out for malicious versions without any elevation of privileges or installation. Because that's how they are supposed to work. So, that's a given, and we can assume that this is a factor.

Isn't running code from anywhere but C:\Program Files, etc inherently dangerous?

"inherently dangerous"? Of course not. And this is where the logic starts to go astray. Having an approved directory structure where binaries should be executed is a handy, easy, simple, and predictable way to enforce binary execution policies. Some hardened systems do only allow binaries to be executed from a protected directory structure. But the ease of adding controls in one case does not mean that the other case is "inherently dangerous".

Does being able to execute binaries from any arbitrary place in the system introduce weaknesses? Sure. It's more difficult to control what apps are approved. But not impossible.

why don't we see this kind of attack all the time?

Because it would have to be not a niche case to be relevant "all the time".

The point of the attack would be to place the app in such a way that the user of the system would choose to run it as a normal part of the user's operating of the system. Because if the attacker could replace the app and execute it themselves, then why replace an existing app at all?

For this attack to make sense, an attacker would have to:

  • have access to the system to be able to delete/replace the app, and if they could do that, there are far worse things they could do
  • know that the app would be executed by the user and not just "hanging around" for convenience, which brings an element of uncertainty and unpredictability for the attacker
  • create the malicious app in a way that would avoid anti-virus protections

All of these factors are in the way of this being an issue "all the time". Possible? Of course. But not a major or universal threat.


If an attacker has permissions to overwrite files within your homefolder, you've already lost.

  • Then why are there folders that require admin privileges to be written to?
    – Martin
    Sep 20, 2022 at 7:44
  • @Martin if you could overwrite things in C:\Windows or C:\Program Files then they might be executed by other users, which could allow you to compromise their accounts or escalate your privileges. But if you're overwriting things in your own homefolder, they're only going to be executed by you, so there's no security boundary being broken.
    – Gh0stFish
    Sep 20, 2022 at 12:15
  • @Gh0stFish: No, not necessary. If the app needs admin permissions to perform malicious actions and you are logged in as a normal user, then the consequences can be not as bad as in the case you give the app admin permissions to the infected installer.
    – mentallurg
    Sep 20, 2022 at 18:38
  • @Martin: Exactly. This is a way to protect important files from hidden modifications. Any write operation to such directories needs to be given explicitly.
    – mentallurg
    Sep 20, 2022 at 18:43
  • 1
    2) In other scenario I am not talking about installer at all. I am saying, that if a user with normal non-admin permissions is using (not installing) an infected file, then it will be easier to notice when it requires admin permissions, when it is expected not to need any admin permissions.
    – mentallurg
    Sep 21, 2022 at 20:22

If your goal is to avoid executing potentially hostile code, you're better served with code signing that some poor man version of Trusted Path Execution. But in any case both are defeated by the presence of an executable interpreter (on purpose or not), which is the case on most systems not hardened to the point of unusability.

  1. Installing means not unpacking. It can be much more complex, e.g. registration of components in the registry. You cannot reach that by just unpacking. That's why it is incorrect to say that "pretty much every Windows app" has a portable version.

  2. "C:\Program Files" has no any special meaning from the security point of view. Launching executables from this directory is not safer than launching from any other directory. Besides, many installers allow to specifiy the destination directory, and you can install to any directory you want.

  3. If the attacker can modify the downloaded portable app, then this attacker can modify the downloaded installer as well. Launching an infected installer has the same risk as launching a portable app.

  4. If you carefully launch portable apps, this can be even more safe compared to installer. Installers require usually admin permissions to be able to write to the system directories like C:\Windows\System32 and to write to the registry. That's why users normally give such permissions. If you are logged in as a normal user, not an admin, and launch a portable app, you can better control the application. For instance, if you launch a simple text editor and it requires more permissions, e.g. to modify some system file, you can reject the request.

  • 1
    \Program Files absolutely has a security-relevant meaning: it and all of its subfolders (by default) can only be written to with Admin-level privileges. This obviously doesn't mean anything if you run with permanent admin privs and so does everything else on the computer, but it means a LOT compared to if e.g. your low-privilege webserver is taken over, and it can't write to Program Files but can write to the flashdrive you keep your portable apps on. This is admittedly an unlikely scenario for a home user, though.
    – CBHacking
    Sep 20, 2022 at 5:55
  • @CBHacking: Sure. But the OP is saying not about generic case like an attack via web server. The OP is about portable apps. The OP assumes that the attacker can modify the binary after it was downloaded. Installation usually requires admin permissions. Thus execution of an infected installer can modify any file in C:\Program Files. Execution of infected files from C:\Program Files does not differ from execution from other locations.
    – mentallurg
    Sep 20, 2022 at 8:48
  • @mentallurg precisely because I'm talking about portable apps is that I'm assuming nothing gets written to C:\Program Files, and thus no admin privileges are needed. I never mentioned executing an infected installer.
    – Martin
    Sep 20, 2022 at 12:45
  • @Martin: You wrote "an attacker with access to your system could quickly swap the newly-downloaded app" This means, the attacker could swap not only the portable app, but also the installer. The attacker would infect any downloaded file. There is no difference. This is the reason why using portable app might be more safe in some cases.
    – mentallurg
    Sep 20, 2022 at 18:30
  • 1
    @mentallurg First, you only need to execute the installer once, and if you're somewhat careful you can take precautions when doing so (like checking signatures) that you wouldn't for a tool you run regularly. If the attacker shows up / gets code execution after the installer has run, then swapping/modifying the installer does nothing, while swapping the portable executable still is an effective attack. Second, how is a portable app safer? Are you comparing the app - run many times - with the installer, run once?
    – CBHacking
    Sep 21, 2022 at 8:08

Even attackers observe the gain/cost ratio.

Not every user uses portable apps. IMHO, the fact is the casual user ignores them. That means that you would invest in an attack having few possible targets. It terribly lowers the expected gain because it is the product of the number of possible target by the attack efficiency.

Portable apps can reside anywhere in the system including on removable media. It adds a complexity level, because you have to search for something without knowing where it is nor even if it is currently present. Furthermore, it could have been renamed at installation time, which adds a risk of not finding it even if it is present...

In the end, it is generally thought more efficient to propose copies of innocent apps, either portable or installable ones, but that have been specially crafted to contain malware code. It is easier than first gaining access to a system without even knowing whether the attack vector will be there.

Of course, if the considered threat is your little brother/sister attacking your system, they already have physical access to your system, and can know what tools you use. In that threat model, portable apps are a very easy attack vector, and if you use them you should protect them.

  • What investment? The attack could simply be: 1. discover a portable app on the system, 2. replace it with meterpreter.exe, 3. rename and change the icon to match what you removed. There is no need to infect the legitimate app. The entire thing could be purely opportunistic.
    – schroeder
    Sep 22, 2022 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .