Bug Hunter Claims Windows Flaw Can Hide Hazards

Microsoft's Windows Explorer and Web browser Internet Explorer can be tricked into masking dangerous files as innocent ones, a security specialist says.

Hackers can exploit the flaw so unknowing PC users may run arbitrary programs, potentially ruining their systems, according to Bulgarian bug hunter Georgi Guninski, a well-known Microsoft gadfly.

By adding a certain CLSID (Class Identifier) to a file name, Windows Explorer and IE will show any file extension designated by the file's creator, instead of showing an extension that accurately reflects what kind of file it is, Guninski says. CLSIDs consist of a string of numbers between curly brackets.

A file may appear to be an innocent ".txt" (text) file, but could in fact be an "HTA" (HTML Application) file, which can run programs on a PC. The damage occurs when someone double-clicks the file to open it. The malicious file could also be portrayed as any other file type, such as various graphics formats.

Disguising a Virus

The flaw could also disguise Visual Basic Script files that contain viruses. Many recent viruses, including the far-reaching Love Letter, are VBS (Visual Basic) files. Warnings about the virus caution users to not open files with the .VBS extension--but by using a CLSID, a virus-spreader could disguise a VBS file as an apparently harmless .txt file.

Guninski said he informed Microsoft of his finding on April 11. Microsoft did not return repeated calls requesting comment.

The bug hunter rates the problem as "high risk" and suggests Windows users not double-click on files in Windows Explorer or IE.

However, there's a way to identify such a masked file, a quick test shows. Windows Explorer and IE won't associate the appropriate program icon with the file. The .txt file made by Guninski for test purposes did not carry the icon for the Windows Notepad program. Also, the file's properties--displayed by right-clicking on the file name and selecting Properties from the menu--will reveal the actual file type.