4 ms·
If your email firewall allows random .sh attachments, then you are vulnerable to at least two attacks: 1. Someone targets you specifically, knowing you are a s
by jorangreef 7y ago
If your email firewall allows random .sh attachments, then you are vulnerable to at least two attacks:
1. Someone targets you specifically, knowing you are a software developer, by impersonating a trusted third-party contact and sending you a ZIP attachment with the contents of an open source project you are known to work on. ZIP attachments preserve the executable bit, and you wouldn't see any .sh extension because it would be an extension-less shell script. It would probably just look like a binary you are used to clicking.
2. Someone impersonates a trusted third-party contact, sending you a ZIP attachment with a symlink traversal to overwrite your .bashrc as soon as you unzip the attachment with a double-click, or as soon as unpatched middleware unzips it for you.