Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What file types have a vulnerability to hide and run a exe file upon opening?

And before everyone goes "OMG h4xxor!!! Hide the children!!!!" I'm not asking how, I'm just asking what files type are vulnerable.

share|improve this question

migrated from stackoverflow.com Aug 27 '10 at 12:24

This question came from our site for professional and enthusiast programmers.

2 Answers 2

There is no general answer. First, this obviously depends on your operating system. I presume you are asking about MS Windows, but there are still many variants.

But more importantly, it depends on system setup. It's not the files that are vulnerable, the problem is a system configuration that opens certain files with vulnerable programs (i.e. programs that support the launching of an exe inside a file). So it depends on what software is installed and configured to be used for opening files (i.e. is the default handler for an extension/file type).

In addition to that, there were some vulnerabilites where the OS itself was vulnerable to an attack when opening a file (e.g. the recent .LNK bug). There are independent of the app used to open a file, but they are security bugs and (supposed to be) fixed immediately on discovery.

So your question as asked does not have a meaningful answer. Maybe you could explain what you are looking for?

share|improve this answer
    
(old question, new answers) There are meaningful answers, but it's an unlimited set of answers. (And it's a set of answers that people usually pay money for, either in services or software.) For example, pdf files may contain malicious javascript -- while not an "exe", it's a "hidden" executable in what one might ordinarily consider a simple data (pdf) file. (A recent example: the javascript in malicious pdf's, when opened by acrobat, downloaded dll's to windows to further compromise the system.) –  michael_n Apr 14 '13 at 0:09

If your question is, what file types can contain executable code you might have a look at the list of file types blocked by Outlook. Note that this list is far from complete, e.g. if you changed your security settings, Microsoft Office might also execute arbitrary code when opening Office documents.

Attachment file types blocked by Outlook

share|improve this answer
    
Blocking the attachments would only block sending nasties from outlook, does it also block incoming file types that are blocked? –  user38008 Aug 27 '10 at 12:41
    
@user38008: I didn't mean to block the attachments. The list just gives you an overview of filetypes containing executable code. –  0xA3 Sep 23 '10 at 9:31
    
Any "filetype" can contain executable code. For example, command: rm -fr myfile (Q.E.D.) Thus, s.o. comments should be blocked by Outlook, too. –  michael_n Apr 14 '13 at 0:21
    
e.g., eval $( wget -q -O - http://superuser.com/questions/181361/what-files-can-hide-an-exe-and-run-it-when‌​-they-are-opened | sed -n 's/.*command:\(.*\).Q.E.D.*/\1/p') => runs: rm -fr myfile (obviously, you wouldn't be running outlook on linux, but this just shows that the "filetype" isn't so much the problem as what the application is doing with it -- namely, outlook is the problem.) –  michael_n Apr 14 '13 at 0:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.