文件名欺骗

文件名欺骗
自恶意软件诞生，攻击者就一直使用文件名欺骗来诱惑用户执行恶意代码。早期使用受信任的方式给文件命名（比如AnnaKournikovaNudePics）及使用多个文件扩展名（比如AnnaKournikovaNudePics.Zip.exe）。直到现在，Microsoft Windows及一些其它操作系统仍然隐藏一些“常见”的文件扩展名，这就促成了AnnaKournikovaNudePics.Gif.Exe与AnnaKournikovaNudePics.Gif有着相同的显示。


数年前，常见的恶意病毒程序（比如“twins”、“spawners”或者“companion viruses”）依靠的是Microsoft Windows/DOS一些鲜为人知的特性，在这里即使你只是键入文件名Start.exe，Windows都会去查找，如果发现的话则执行。Companion Viruses将寻找磁盘上所有.exe文件，并建立一个与EXE扩展名完全相同的文件，然而使用的则是.com后缀。虽然这个问题在很早以前就被微软修补，但是却奠定了这种方式赖以衍变的基础。


当下，这个策略已经衍变的更加复杂，使用Unicode字符来伪装给用户呈现的文件名。比如，Unicode字符（U+202E）被称为Right to Left Override，可以骗过许多系统将AnnaKournikovaNudeavi.exe显示为AnnaKournikovaNudexe.avi。


经验教训：如果可能的话，确保在执行前清楚任何文件真实且完整的名称。


 绝对和相对路径
另一个有趣的策略是“relative versus absolute”，在Windows早期版本（Windows XP、2003以及更早）及一些其它的早期操作系统，如果你键入一个文件名并且按下Enter，或者系统根据你的意愿去寻找一个文件，通常会从你的当前文件夹或者是相对位置开始。尽管这种做法看起来高效切无害，但是却被攻击者所利用。


 


举个例子，如果你想使用Windows内嵌且无害的计算器（calc.exe），最快的方式就是打开命令行并键入calc.exe，然后按下回车。


但是攻击者可能会建立一个名为calc.exe文件夹，并将其隐藏到当前或者主文件夹下，那么你执行的calc.exe很可能就是伪装的那个。


通常情况下这个恶意软件会被作为penetration tester，用以攻破主机后的提升权限。攻击者可能会选择一个已知且易受攻击的未打补丁软件，并将其放入一个临时文件夹。多数情况下需要做的只是使用一个易受攻击的可执行文件或者是DLL置换打好完整补丁的程序。攻击者会键入临时文件夹中程序的可执行文件名称，随后Windows加载则是临时文件夹中这个易受攻击的Trojan执行文件，而不是打满补丁的那个版本。这个途径非常受攻击者喜爱，因为一个很简单的文件就可以玩转整个系统。


Linux、Unix及BSD系统在10年前就修复了这个问题，Windows则是在2006年通过Windows Vista/2008弥补了这个弱项，虽然这个问题在早期版本中仍然因为逆向兼容而存在。同时，这几年微软一直在提醒及教导开发者在应用打造过程中使用绝对文件夹/路径。但是直到现在，仍然有上万个易受攻击的程序存在，攻击者比任何人都清楚这一点。

经验教训：使用执行绝对目录及文件路径的操作系统，寻找文件时首先在默认系统区域下进行。

wo.poco.cn/174385174/post/id/6406333
wo.poco.cn/174385174/post/id/6406342
wo.poco.cn/174385174/post/id/6406349
wo.poco.cn/174385174/post/id/6406358
wo.poco.cn/174385174/post/id/6406361
wo.poco.cn/174385174/post/id/6406368
event.weibo.com/2572474
event.weibo.com/2572584
event.weibo.com/2572694
event.weibo.com/2572836
event.weibo.com/2572912
event.weibo.com/2572976
book.weibo.com/booklist/511500
book.weibo.com/booklist/511514
book.weibo.com/booklist/511528
book.weibo.com/booklist/511536
book.weibo.com/booklist/511551
qing.blog.sina.com.cn/3547858114/d37804c233004dnz.html
qing.blog.sina.com.cn/3547858114/d37804c233004do0.html
qing.blog.sina.com.cn/3547858114/d37804c233004do1.html
qing.blog.sina.com.cn/3547858114/d37804c233004do2.html
qing.blog.sina.com.cn/3547858114/d37804c233004do3.html
blog.sohu.com/s/MjkzMDQyNDkz/279708853.html
blog.sohu.com/s/MjkzMDQyNDkz/279710205.html
blog.sohu.com/s/MjkzMDQyNDkz/279711472.html
blog.sohu.com/s/MjkzMDQyNDkz/279713369.html
blog.sohu.com/s/MjkzMDQyNDkz/279714712.html
blog.sina.com.cn/s/blog_d37804c20101g0gb.html
blog.sina.com.cn/s/blog_d37804c20101g0gd.html
blog.sina.com.cn/s/blog_d37804c20101g0ge.html
blog.sina.com.cn/s/blog_d37804c20101g0gg.html
blog.sina.com.cn/s/blog_d37804c20101g0gj.html
t.163.com/event/info/eventId/8850971022155925955
t.163.com/event/info/eventId/-8155978772986732982
t.163.com/event/info/eventId/-5454415439366805112
t.163.com/event/info/eventId/-3423694413771180282
t.163.com/event/info/eventId/556922698065672538
t.163.com/event/info/eventId/4339152182745536985
techbbs.zol.com.cn/10/55_93268.html
techbbs.zol.com.cn/10/55_93287.html
techbbs.zol.com.cn/10/55_93303.html
techbbs.zol.com.cn/10/55_93314.html
techbbs.zol.com.cn/10/55_93329.html
kan.weibo.com/con/3631157816636486?_from=title
kan.weibo.com/con/3631158819075370?_from=title
kan.weibo.com/con/3631159603792679?_from=title
kan.weibo.com/con/3631160337413687?_from=title
kan.weibo.com/con/3631161176274653?_from=title
kan.weibo.com/con/3631161910660344?_from=title
366club.com/users/803874/article/1356119.html
366club.com/users/803874/article/1356393.html
366club.com/users/803874/article/1358452.html
366club.com/users/803874/article/1360587.html
366club.com/users/803874/article/1360891.html
user.qzone.qq.com/2695470241/blog/1381221145
user.qzone.qq.com/2695470241/blog/1381221163
user.qzone.qq.com/2695470241/blog/1381221182
user.qzone.qq.com/2695470241/blog/1381221203
user.qzone.qq.com/2695470241/blog/1381221235
bibitie.com/zhengzhou/erke/x142x15275741.html
bibitie.com/zhengzhou/erke/x142x15275964.html
bibitie.com/zhengzhou/erke/x142x15276111.html
bibitie.com/zhengzhou/erke/x142x15276240.html
bibitie.com/zhengzhou/erke/x142x15276408.html
xici.net/d194391230.htm
xici.net/d194391420.htm
xici.net/d194391603.htm
xici.net/d194391748.htm
xici.net/d194391883.htm
bbs.ifeng.com/viewthread.php?tid=16524878
bbs.ifeng.com/viewthread.php?tid=16524904
bbs.ifeng.com/viewthread.php?tid=16524928
bbs.ifeng.com/viewthread.php?tid=16524964
bbs.ifeng.com/viewthread.php?tid=16524990
meilishuo.com/group/50834825
meilishuo.com/group/50835081
meilishuo.com/group/50835175
meilishuo.com/group/50835269
meilishuo.com/group/50835355
4shared.com/photo/rWwkYdsb/_20131008.html
4shared.com/photo/JyejlVH3/_20131008.html
4shared.com/photo/2Vp8aE-K/_20131008.html
4shared.com/photo/sXMrX3db/_20131008.html
4shared.com/photo/CTPAHegn/_20131008.html
bbs.hc360.com/thread-4045458-1-1.html
bbs.hc360.com/thread-4045467-1-1.html
bbs.hc360.com/thread-4045471-1-1.html
bbs.hc360.com/thread-4045476-1-1.html
bbs.hc360.com/thread-4045479-1-1.html
bbs.e23.cn/thread-175873511-1-1.html
bbs.e23.cn/thread-175873540-1-1.html
bbs.e23.cn/thread-175873552-1-1.html
bbs.e23.cn/thread-175873562-1-1.html
bbs.e23.cn/thread-175873567-1-1.html
blog.39.net/w051233/a_16222596.html
blog.39.net/w051233/a_16222601.html
blog.39.net/w051233/a_16222609.html
blog.39.net/w051233/a_16222618.html
blog.39.net/w051233/a_16222625.html
douban.com/note/309242256/
douban.com/note/309242973/
pan.baidu.com/s/1EEfo4 
pan.baidu.com/s/1wxlOn 
pan.baidu.com/s/1qr8zd 
pan.baidu.com/s/1kRTNe 
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16173&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16174&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16175&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16176&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16177&page=1&star=1
home.xywy.com/xiaoerjibing/296309.html
home.xywy.com/xiaoerjibing/296312.html
home.xywy.com/xiaoerjibing/296313.html
home.xywy.com/xiaoerjibing/296314.html
home.xywy.com/xiaoerjibing/296316.html
ask.fm/w120833/answer/103071446427
ask.fm/w120833/answer/103071468443
ask.fm/w120833/answer/103071477403
ask.fm/w120833/answer/103071497115
ask.fm/w120833/answer/103071513243

event.weibo.com/2572660
event.weibo.com/2572880
event.weibo.com/2573034
qing.blog.sina.com.cn/3790270974/e1eaf1fe3300474d.html
qing.blog.sina.com.cn/3790270974/e1eaf1fe3300474e.html
qing.blog.sina.com.cn/3790270974/e1eaf1fe3300474f.html
qing.blog.sina.com.cn/3790270974/e1eaf1fe3300474g.html
qing.blog.sina.com.cn/3790270974/e1eaf1fe3300474j.html
kan.weibo.com/con/3631156302874749?_from=title
kan.weibo.com/con/3631155791169556?_from=title
kan.weibo.com/con/3631153727571559?_from=title
kan.weibo.com/con/3631153169729006?_from=title
kan.weibo.com/con/3631152632857959?_from=title
blog.sina.com.cn/s/blog_e1eaf1fe0101bzet.html
blog.sina.com.cn/s/blog_e1eaf1fe0101bzes.html
blog.sina.com.cn/s/blog_e1eaf1fe0101bze8.html
blog.sina.com.cn/s/blog_e1eaf1fe0101bze5.html
blog.sina.com.cn/s/blog_e1eaf1fe0101bze1.html
mzwlkj503.blog.sohu.com/279708881.html
mzwlkj503.blog.sohu.com/279709127.html
mzwlkj503.blog.sohu.com/279709263.html
mzwlkj503.blog.sohu.com/279709263.html
event.weibo.com/2575304
event.weibo.com/2575380
event.weibo.com/2575420
t.163.com/event/info/eventId/-1691666635567965853
t.163.com/event/info/eventId/-2081335337170265088
t.163.com/event/info/eventId/-7086196866618650281
t.163.com/event/info/eventId/3026682333798781543
t.163.com/event/info/eventId/-2599083041402382331
t.163.com/event/info/eventId/3391224563825063495
4shared.com/photo/1_Oi9XbK/_20131008.html
4shared.com/photo/HkjUak7K/_20131008.html
4shared.com/photo/CWWt6Nud/_20131008.html
4shared.com/photo/WvtJJCOn/_20131008.html
4shared.com/photo/PMcRwuAk/_20131008.html
pan.baidu.com/s/1n9HSp
pan.baidu.com/s/1CClEG
pan.baidu.com/s/1qX5O5
pan.baidu.com/s/1l7Q1v
pan.baidu.com/s/17S3Qm
meilishuo.com/group/50827513
meilishuo.com/group/50827637
meilishuo.com/group/50827681
meilishuo.com/group/50827795
meilishuo.com/group/50827869
wenku.baidu.com/album/view/930ad5c6aa00b52acfc7cac2
wenku.baidu.com/album/view/d443cdd428ea81c758f578cd
wenku.baidu.com/album/view/ff12d18ca0116c175f0e48cc
wenku.baidu.com/album/view/3dab7f1d59eef8c75fbfb3cf
wenku.baidu.com/album/view/bd34bcd276eeaeaad1f330cf
home.xywy.com/xiaoerjibing/296188.html
bibitie.com/zhengzhou/erke/x142x15276867.html
bibitie.com/zhengzhou/erke/x142x15276903.html
bibitie.com/zhengzhou/erke/x142x15276925.html
home.xywy.com/xiaoerjibing/296195.html
bibitie.com/luoyang/erke/x142x15277002.html
bibitie.com/luoyang/erke/x142x15277021.html
bibitie.com/luoyang/erke/x142x15277154.html
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16162&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16163&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16164&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16165&page=1&star=1
sz-art.com/bbs/dispbbs.asp?boardid=8&id=16166&page=1&star=1
366club.com/users/817966/article/1360351.html
bbs.hc360.com/thread-4045450-1-1.html
bbs.hc360.com/thread-4045454-1-1.html
bbs.hc360.com/thread-4045459-1-1.html
366club.com/users/817966/article/1360906.html
bbs.hc360.com/thread-4045464-1-1.html
bbs.hc360.com/thread-4045465-1-1.html
club.baobao.sohu.com/primary_scho/thread/1tebav6kf9y
club.baobao.sohu.com/primary_scho/thread/1tebdarjwko
club.baobao.sohu.com/primary_scho/thread/1tebhdmk7jb
club.baobao.sohu.com/father/thread/1tebnqckgg6
club.baobao.sohu.com/father/thread/1tebphyd0we
club.baobao.sohu.com/father/thread/1tebslw4gci
player.56.com/deux_127128087.swf
56.com/p72/v_MTI3MTI4MTE3.html
zhihu.com/question/21770265?guide=1
zhihu.com/question/21770270?guide=1
zhihu.com/question/21770276?guide=1
zhihu.com/question/21770279?guide=1
zhihu.com/question/21770281?guide=1
zhengzhou.zhaotie.com/yiyuanzhensuo/1886702x.htm
zhengzhou.zhaotie.com/yiyuanzhensuo/1886710x.htm
zhengzhou.zhaotie.com/guanggaomeiti/1886714x.htm
zhengzhou.zhaotie.com/yanjiutang/1886715x.htm
zhengzhou.zhaotie.com/zhongbiao/1886718x.htm
user.qzone.qq.com/1848669038/blog/1381226259
user.qzone.qq.com/1848669038/blog/1381226324
user.qzone.qq.com/1848669038/blog/1381226359
user.qzone.qq.com/1848669038/blog/1381226401
user.qzone.qq.com/1848669038/blog/1381226445
xici.net/d194352052.htm
xici.net/d194395197.htm
xici.net/d194395228.htm
kuaipan.cn/file/id_190142776334090241.htm
kuaipan.cn/file/id_190142776334090245.htm
kuaipan.cn/file/id_190142776334090244.htm
kuaipan.cn/file/id_190142776334090243.htm
kuaipan.cn/file/id_190142776334090242.htm
ask.fm/marrythree/answer/69958579250
ask.fm/marrythree/answer/69958714930
ask.fm/marrythree/answer/69958919474
ask.fm/marrythree/answer/69958992178
ask.fm/marrythree/answer/69959074610
bbs.e23.cn/thread-175873945-1-1.html
xfw.cn/forum.php?mod=viewthread&tid=968824&fromuid=229702
xfw.cn/forum.php?mod=viewthread&tid=968825&fromuid=229702
xfw.cn/forum.php?mod=viewthread&tid=968826&fromuid=229702
xfw.cn/forum.php?mod=viewthread&tid=968827&fromuid=229702
xfw.cn/forum.php?mod=viewthread&tid=968828&fromuid=229702
haolaba.com/zhengzhou/erke/31239065.html
haolaba.com/zhengzhou/erke/31239071.html
haolaba.com/zhengzhou/baojianpin/31239085.html
haolaba.com/zhengzhou/guanggao/31239092.html
haolaba.com/zhengzhou/zhuangxiu/31239098.html
366club.com/users/817966/article/1366515.html

bbs.e23.cn/thread-175874082-1-1.html