What files can hide an exe and run it when they are opened?

Question

What file types have a vulnerability to hide and run a exe file upon opening?

And before everyone goes "OMG h4xxor!!! Hide the children!!!!" I'm not asking how, I'm just asking what files type are vulnerable.

Answer 1

There is no general answer. First, this obviously depends on your operating system. I presume you are asking about MS Windows, but there are still many variants.

But more importantly, it depends on system setup. It's not the files that are vulnerable, the problem is a system configuration that opens certain files with vulnerable programs (i.e. programs that support the launching of an exe inside a file). So it depends on what software is installed and configured to be used for opening files (i.e. is the default handler for an extension/file type).

In addition to that, there were some vulnerabilites where the OS itself was vulnerable to an attack when opening a file (e.g. the recent .LNK bug). There are independent of the app used to open a file, but they are security bugs and (supposed to be) fixed immediately on discovery.

So your question as asked does not have a meaningful answer. Maybe you could explain what you are looking for?

Answer 2

If your question is, what file types can contain executable code you might have a look at the list of file types blocked by Outlook. Note that this list is far from complete, e.g. if you changed your security settings, Microsoft Office might also execute arbitrary code when opening Office documents.

Attachment file types blocked by Outlook