Customers may not know the difference between a virus and a worm, but understanding the different types of malware will help you protect their systems -- and pass the SSCP certification exam. This excerpt, from the Official (ISC)²® Guide to the SSCP® CBK® Domain 7: Malicious Code, by Diana-Lynn Contesti, takes a look at double file extensions. Download the full Domain as a PDF to learn about the different types of malware and their payloads.
Viruses, worms and Trojan horses all make use
of the double file extension. The Windows operating systems allows the creation
of files names with a number of spaces in it. This trick is intended to
fool users into believing that the file they are viewing cannot be executed.
as in this example:
PLAIN.TXT.EXE
The .EXE at the end of the spaces, makes the program executable. Unfortunately
in e-mail, users will only see the .TXT and potentially believe that
the file is simply a Text file. This is why much has been done to educate users
on not running e-mail attachments.
As a number of file extensions can be used to deliver or contain malicious
code, it is recommended that the administrators block specific File Extensio
To continue reading for free, register below or login
To read more you must become a member of SearchSecurityChannel.com
ns
at the Firewall. Table 7.3 is a partial list of suggested file extensions
that should be blocked.
It is difficult for end users to understand all the file extensions that can
be used and those that may be considered dangerous or Executable. Therefore,
it is a good idea to develop a list of extensions that will be blocked at
the Firewall by default. Every organization is unique and the list that is correct
for one organization may not be correct for another. It is a good idea to
educate users on some of the basic file extensions that you may not be able
to block (i.e., .EXE, .PIF, .SCR, .COM).
A complete list of file extensions and their meanings is available at
The File Extension Source; also view Every File Extension in the World from WhatIs.com.
Table 7.3 A Partial List of File Extensions That Should Be Blocked
[TABLE]Official (ISC)²® Guide to the SSCP® CBK®
By Diana-Lynn Contesti, Douglas Andre, Eric Waxvik, Paul A. Henry, Bonnie A. Goins
Published by (ISC)2 Press
ISBN # 9780849327742; Copyright 2007; Pages: 573; Edition: 1st
Chapter: Domain 7: Malicious Code
By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, SSCP
