1

I'm kind of a newbie to security and need help fully understanding how I would infect myself inadvertently.

Let's say I was to download a .zip file attached to an email and I unzipped the contents. It's my understanding that the only way my computer would be compromised would be IF I EXECUTED any of those files contained within...right? Just simply having them on my hard drive does nothing...right?

|improve this question
  • Not all zips are created equal - I could see a self-extracting zip being modified to introduce malware of some sort. Those do have a .exe extension, though. – KnightOfNi Oct 16 '14 at 22:09
3

Generally speaking, you are correct. Let's look at some exceptions:

  • If the malware exploits a vulnerability in your email program.
  • If the malware exploits a vulnerability in the software used to "unzip" it.
  • If the malware exploits a vulnerability in the software used to view its contents (ie Windows Explorer).
  • If the malware exploits a vulnerability in the program used to open an extracted.
  • If the files are used by other software, for which an exploit exists. I say this because you specified "executed" not "opened".
  • If the software is inadvertently ran by something else. For example, a DLL could be loaded and ran by some other software.
|improve this answer
  • How would opening a JPG run a EXE? (without exploiting a bug in the image viewer) – Ángel Oct 16 '14 at 22:18
  • @Ángel My bad, I included that because I remember it was something used many years ago, turns out it was a GDI bug which is already covered by my checklist! – user41341 Oct 16 '14 at 22:25
  • Thank you ALL for your responses, i feel i understand now. I do have another question however. Is it possible to be infected from a .avi,.mp4, etc.. file? That .avi or .mp4 then would have to target a SPECIFIC program i use to open it no? one cannot simply embed an exe into an .avi/.mp4 right? – Ron Burgundy Oct 16 '14 at 23:41
  • Mostly correct. It would have to target an exploit one way or another, although it's possible for multiple products to be vulnerable. If 5 programs all rely on the same 3rd party library to decode an mp3 stream, and a vulnerability was found in that library, then all 5 programs would be affected. – user41341 Oct 16 '14 at 23:58
  • Just to add value to this comment, there have actually been exploits discovered in AV software that execute arbitrary code in specially crafted files when scanned! iss.net/security_center/reference/vuln/Email_Escaped_Quote.htm, not the only one over the years, and as systems run many automated processes in the background not the only one to have been exploited. So simple possession of a file without user interaction can and has infected machines... As that file could have been temporary in the background of any application doing its normal duty, there is never a true never... – Sabre Oct 17 '14 at 2:54
1

Yes. Just having a file on your hard drive does nothing.

However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens and parses the pdf… and infects you. Or you are running an automatic indexing process, that tries to parse the pdf, leading to the infection.

This is quite uncommon, as exploits are usually particular to a specific program, and it's more likely that you use a different reader and thus don't execute the exploit that you inadvertenly run it by using something other than the reader they were trying to infect (however the same software may be providing the viewer and the plugin…). But although unlikely, inadvertent execution by unknown pieces in your software stack is a risk to take into account.

Another class of attacks would be based on files with some names being special for some programs.

  • A file named .profile would be harmless on Unix unless you happen to put it in your home folder. Then the shell will happily run it on next login (this is what made user-controlled filenames CVE-2010-2252).

  • Under certain conditions, it is possible that a .dll you extracted will get run if you then open from that same folder a program that uses a dll with that same name.

|improve this answer
  • Reminds me of how one of my co-workers got hit with the FBI randomware virus when he opened a PDF on his work computer. Turns out Adobe Reader is almost universally standard unless you use the PDF reader built into Firefox or Chrome. – user41341 Oct 16 '14 at 22:32
  • What about Dir-II virus? – Ulkoma Oct 16 '14 at 22:55
  • 1
    @Ulkoma, Dir II required execution. It then infected existing .exe / .com files. – Ángel Oct 16 '14 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.