4 ms·

> Windows email clients tend to run code in attachments just by clicking them Citation please? This is not my experience.

littlestymaar 7y ago
On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.
- skrebbel 7y ago
  In an email client? Without any warning of sorts? Which email client is that? Also, for many years already, Windows won't let you run an executable that you just downloaded from the internet just by double clicking, without first clicking through a warning dialog.
  - jorangreef 7y ago
    Yes, but then again warning dialogs don't have much track record in preventing malware outbreaks. For example, recent versions of Word won't run VBA macros by default without the user clicking through a warning dialog, and yet people fall for it all the time. Malware authors don't mind either way.
    - skrebbel 7y ago
      I didn't say anything about that. I'm only refuting the claim that Windows email clients will run an executable just by clicking on them.
      - jorangreef 7y ago
        Well, then I would disagree with you there. There are plenty of ways to get Windows to run executable code just by clicking an attachment, and this even without warning dialogs: - PDFs with JS code. It's not a joke, someone actually titled a paper on PDF exploits alone, "PDF, Let Me Count the Ways". - Hostile RTFs (with or without OLEs) disguised as Word documents (which Office will gladly open). - Hostile HTML disguised as Excel spreadsheets (likewise). - New unknown variants of the old Windows metafile exploit (just by viewing, as xorcist suggested). - Image "stegosploits" (likewise). The list goes on...
- kevingadd 7y ago
  I've literally never used a mail client that behaves this way. If the EXE even makes it past attachment scanners, I get a 'save'/'run' prompt and then if it's not signed and trusted, SmartScreen usually prompts me again to confirm that I really want to run it. The app is usually in an installer package or ZIP which adds a couple more execute barriers. The real threat is malware hidden in document formats like docx or pdf, which usually have fewer clicks before open + get exploited.

littlestymaar 7y ago

On windows, when you (double)click on an executable file it runs, because that's the default action for executables. On Unixes you need to mark the file as executable (with `chmod`) for this to happen.

skrebbel 7y ago
In an email client? Without any warning of sorts? Which email client is that? Also, for many years already, Windows won't let you run an executable that you just downloaded from the internet just by double clicking, without first clicking through a warning dialog.
- jorangreef 7y ago
  Yes, but then again warning dialogs don't have much track record in preventing malware outbreaks. For example, recent versions of Word won't run VBA macros by default without the user clicking through a warning dialog, and yet people fall for it all the time. Malware authors don't mind either way.
  - skrebbel 7y ago
    I didn't say anything about that. I'm only refuting the claim that Windows email clients will run an executable just by clicking on them.
    - jorangreef 7y ago
      Well, then I would disagree with you there. There are plenty of ways to get Windows to run executable code just by clicking an attachment, and this even without warning dialogs: - PDFs with JS code. It's not a joke, someone actually titled a paper on PDF exploits alone, "PDF, Let Me Count the Ways". - Hostile RTFs (with or without OLEs) disguised as Word documents (which Office will gladly open). - Hostile HTML disguised as Excel spreadsheets (likewise). - New unknown variants of the old Windows metafile exploit (just by viewing, as xorcist suggested). - Image "stegosploits" (likewise). The list goes on...
kevingadd 7y ago
I've literally never used a mail client that behaves this way. If the EXE even makes it past attachment scanners, I get a 'save'/'run' prompt and then if it's not signed and trusted, SmartScreen usually prompts me again to confirm that I really want to run it. The app is usually in an installer package or ZIP which adds a couple more execute barriers. The real threat is malware hidden in document formats like docx or pdf, which usually have fewer clicks before open + get exploited.