7

I'm reading up on the Cryptolocker virus, and I came across this comment, it says:

And one additional measure: disable the default "Hide extensions for known file types" check box in Explorer. I still consider this one of the stupidest moves MS ever made in Windows.

The comment has 17 thumbs up, and comments below agreeing. I've never heard this before? How does this make a system more secure?

JMK
  • 2,506
  • 7
  • 29
  • 40

2 Answers2

19

Consider a file named doubleclick.pdf.bat. If "Hide extensions" is enabled, then this will be shown in File Explorer as "doubleclick.pdf". You, the user, might go ahead and double click on it, because it's just a PDF, right? It'll load up in Acrobat if you do that, right? When, in truth, it's a batch file, and whatever commands it contains will run when you double click on it.

That's why "Hide extensions for known file types" is a stupid move in Security terms. It allows an attacker to create wolf files that look like sheep.

gowenfawr
  • 72,893
  • 17
  • 165
  • 200
  • 10
    While I agree in principal, it is worth pointing out that in the real world, most users that actually would recognize what a file type is have disabled hiding extensions anyway and those who don't would click "AwsomePictures.bat.exe.com.warez.notavirus.jpg.ru.bat" even if they had file extensions shown. – AJ Henderson Dec 30 '13 at 17:08
  • And then you have the 3rd type of user, who don't need to see the extension to know what file type it is, and know about basic file security hygiene.... – AviD Dec 30 '13 at 19:21
  • 2
    +1 with an explanation: This is more for those who are new/unfamiliar with computers, like my brothers. Because file types were hidden, they never learned that there are different types of files, so they double-click everything all willy-nilly. – Izkata Dec 30 '13 at 20:08
  • Well that seems obvious now! I was thinking it was because of some complicated technical reason that I wasn't aware of, Occam's razor! – JMK Dec 31 '13 at 13:51
7

This is to make sure that you don't accidentally launch an executable that makes itself appear to be a document. This is not really a security gain in my opinion since you still have to be aware of the difference between executable files and data and what file formats have the potential to run unexpected code, however it does make it much simpler to confirm what you are clicking on when you do know what extensions mean.

Exposing hidden/system files and showing file extensions are two of the first things I do on any computer I touch simply because it is important information that shouldn't be hidden unless you can trust everything that could possibly be on the system. Showing hidden files and folders makes it a little bit harder for malware to hide (though rootkits would still conceal them) and showing extensions makes sure that "MyWordFile" is actually "MyWordFile.doc" and not "MyWordFile.exe".

Both only help a knowledgeable user since your average user will still open MyWordFile.exe without thinking anything of it though.

AJ Henderson
  • 42,081
  • 5
  • 65
  • 112