Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What are ways to avoid or prevent files with the RLO (Right-to-Left Override) Unicode character in their name (a malware method to spoof filenames) from being written or read in a Windows PC?

More info on the RLO unicode character here:

Info on the RLO unicode character, as it is used by malware:

Summary of computer virus/unauthorized computer access incident report for October 2011, compiled by Information-technology Promotion Agency, Japan (IPA) [Mirror (Google Cache)]

You can try this RLO character test webpage to see how the RLO character works.

The RLO character is also already pasted in the 'Input Test' field in that webpage. Try typing there and notice that the characters you're typing are coming out in their reverse orders (right-to-left, instead of left-to-right).

In filenames, the RLO character can be specifically positioned in the filename to spoof or masquerade as having a filename or file extension that is different than what it actually has. (Will still be hidden even if 'Hide extensions for known filetypes' is unchecked.)

The only info I can find that has info on how to prevent files with the RLO character from being run is from the Information Technology Promotion Agency, Japan website.

Can anyone recommend any other good solutions to prevent files with the RLO character in their names from being written or being read in the computer, or a way to alert the user if a file with the RLO character is detected?

My OS is Windows 7, but I'll be looking for solutions for Windows XP, Vista and 7, or a solution that will work for all those OSes, to help people using those OSes too.

share|improve this question
1  
Very good question! I would like to know this too. Your link doesn't seem to work. –  Cerberus Apr 5 '12 at 11:10
    
@Cerberus Just found out that the link doesn't work. I hope it's just temporarily down. I'll update the answer if I find a mirror. –  galacticninja Apr 5 '12 at 13:11
    
webcache.googleusercontent.com/… –  Cerberus Apr 5 '12 at 14:13
    
@Cerberus Thanks. I have added the mirror link to the question. –  galacticninja Apr 6 '12 at 3:34
4  
They adviced to use the Local Security Policy settings manager to block files with the RLO character in its name from being run. Can you please tell us why this is not a solution? –  Tom Wijsman Apr 21 '12 at 9:33

4 Answers 4

You could use Everything in combination with AutoHotkey to create an alert whenever a bidirectional text control character forms part of a filename.

The Script

AlertText = A bidirectional text control character was detected in a filename.
AlertText = %AlertText%`n`nClick OK to re-hide the window.

SetTitleMatchMode RegEx
DetectHiddenWindows, On
EnvGet, ProgramFiles32, ProgramFiles

Start:
Run, %ProgramFiles32%\Everything\Everything.exe
WinWaitActive, Everything, , 5
if Errorlevel
    Goto Start
WinGet, Id, ID, A
StatusBarWait, objects, , 1, ahk_id %Id%
StatusBarGetText, Status, 1, ahk_id %Id%
Backup := ClipboardAll
Transform, Clipboard, Unicode, ‎|â€|‪|‫|‬|‭|‮
Send, ^v
WinHide, ahk_id %Id%
Sleep, 100
Clipboard := Backup
Backup =
StatusBarWait, ^(?!^\Q%Status%\E$)
Loop
{
    StatusBarWait, [1-9], , 1, ahk_id %Id%
    IfWinNotExist, ahk_id %Id%
        Goto Start
    WinShow, ahk_id %Id%
    WinRestore, ahk_id %Id%
    MsgBox, %AlertText%
    WinHide, ahk_id %Id%
}

What it does

The script launches Everything and searches for ‎|â€|‪|‫|‬|‭|‮ (UTF8), i.e., all seven bidirectional text control characters (source), separated by |.

Then, the script hides the Everything window and monitors its status bar. When it contains any digit different from 0, a match has been found, the Everything window gets displayed and the following message box pops up:

A bidirectional text control character was detected in a filename.

Click OK to re-hide the window.

The script also relaunches Everything in case it gets closed.

How to use

  1. Download, install and launch Everything.

  2. Press Ctrl + P and switch to the Volumes tab.

    For all volumes that should be checked, enable Monitor changes.

  3. Download and install AutoHotkey.

  4. Save to above script as find-bidirectional-text-control-characters.ahk.

  5. Double-click the script to launch it.

  6. Create a shortcut to the script in your Startup folder.

share|improve this answer

I don't think such a thing is available on the desktop, but you shuuld be able to prevent such things being written to your fileserver(s):

Implementing File Screening in Windows Server 2003 R2

share|improve this answer

The Information Technology Promotion Agency, Japan website (mirror link), has advised using the Local Security Policy settings manager to block files with the RLO character in its name from being run.

(I am not copypasting the full instructions as I am unsure of what that website's copyright license on their content is.)

share|improve this answer

There are probably other ways, but the easiest - and yet not trivial - way is to implement a file system filter (or file system mini-filter) that filters these requests. In case of reading from such a file you could return STATUS_ACCESS_DENIED and when writing you shouldn't do anything but instead prevent such files from being created (likely also with the above error code) in the first place. Creation is another request type.

One can imagine other methods of achieving a similar result, such as SSDT hooking. But the only reliable way would be the above.

In order to do that you will have to get someone to write this kind of filter for you (relatively trivial for mini-filters for a kernel developer) and then sign it to get it through the kernel mode signing policy since Vista. If you don't want to do the latter you can still test-sign the driver binary and modify your boot options to allow test-signed content - thus compromising security of the respective system, though.

In the light of this information I would strongly advise you to make use of the solution that galacticninja and Tom Wijsman pointed out.

share|improve this answer
2  
"I would strongly advise you to make use of the solution that Tom Wijsman pointed out." Actually, that was a solution that I pointed out. I already set Windows to do that. Like what I replied to Tom Wijsman, I'm looking for other solutions that will prevent the RLO character from being written and read, or a solution that will automatically notify or alert the user if the RLO character is detected. I'm afraid I don't have the technical know-how to write the filter you described. –  galacticninja May 10 '12 at 15:37
    
@galacticninja: I'm sorry, I'll correct that in my answer. –  0xC0000022L May 11 '12 at 22:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.