I was reading an article on .desktop files used to spread malware on Gnome and KDE. I just thought that the same could be applied to Windows.

On Windows:

  1. Malware is disguised as a picture by changing icon. >> Funny pic

  2. User opens it.

  3. Copies itself to a place without UAC (Admin) like My Documents.

  4. Replaces a shortcut like Firefox with its own location and retains the Icon.

  5. The user opens it. Asks for UAC. Even says unsigned.

  6. Windows user ignores the Unsigned warning gives it UAC.

  7. Malware opens Firefox. The user doesn't realise a thing.

  8. The computer is infected.

Would this work? Is UAC required for changing a shortcut of a protected location?

Edit: The whole point of this is to gain UAC without asking for it when it opens but trick the user into giving it UAC impersonating firefox or some other program.


The scenario you have described could possibly work. May not happen in the exact way that you depicted. .desktop files can sit in any location of the victim computer .

NOTE: It needs UAC to get inside a protected location.

Anyway it needs to be executed to starts its actual work. In case of windows just a double click (an execute command in case of Linux).

It can possibly impersonate/imitate any of the program that you recently used or a familiar software in your system.

When the user tries executing/clicking the impersonated file, it asks for UAC as you said. (This is highly detectable by this particular character). If given access then yes you are a successful victim and your computer is compromised.

However removing the .desktop files are not that difficult. Here's a good read about the .desktop files.

  • I know this works in Linux. I'm asking if the same can be implemented in Windows.
    – Ufoguy
    Dec 5 '13 at 9:27
  • @Ufoguy Yes it can be.
    – BlackMamba
    Dec 5 '13 at 9:38
  • Does it require UAC to change the Firefox shortcut to itself? The point of this is to bypass UAC silently. Good when you're spoofing extensions.
    – Ufoguy
    Dec 6 '13 at 7:46
  • It does not exactly replace the existing Firefox shortcut. It can show itself as any icon/shortcut(Firefox in your case). Remember it just has the outward appearance of Firefox shortcut(fake) and does not modifies your Firefox shortcut(original). Since it is not changing the existing file, the need of UAC goes out of the picture.
    – BlackMamba
    Dec 6 '13 at 8:35
  • Then how'd you delete the existing shortcut?
    – Ufoguy
    Dec 7 '13 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.