The most dangerous file type is... what?
Well, you pass if you said ".exe", and get bonus marks for ".pif, because it's just as dangerous thanks to poor type discipline, and more so because of poor UI safely that hides what it is". But today's answer may be neither.
By the time a code file lands up on your system, there's a chance your antivirus will have been updated to know what it is, and may save the attacker's shot at goal. But a link can point to fresh malware code that's updated on the server side in real time; that's far more likely to be "too new" for av to detect, and once it's running, it can kill or subvert your defences.
We need to apply this realization to the way we evaluate and manage risk, to up-rate the risk posed by whatever can deliver Internet links. Think "safe" messages without scripts or attachments, and blog comment spam (including the link from the comment poster's name).
Think also about how HTML allows arbitrary text to overlie a link, including text that looks like the link itself. This link could obviously go to www.bad.com, but it's less obvious that www.microsoft.com could go there instead. Then think how HTML is ubiquitously tossed around as a generic "rich text" interchange medium, from email message "text" to .CHM Help files.
No comments:
Post a Comment