20
5
What are ways to avoid or prevent files with the RLO (Right-to-Left Override) Unicode character in their name (a malware method to spoof filenames) from being written or read in a Windows PC?
More info on the RLO unicode character here:
Info on the RLO unicode character, as it is used by malware:
Summary of computer virus/unauthorized computer access incident report for October 2011, compiled by Information-technology Promotion Agency, Japan (IPA) [Mirror (Google Cache)]
You can try this RLO character test webpage to see how the RLO character works.
The RLO character is also already pasted in the 'Input Test' field in that webpage. Try typing there and notice that the characters you're typing are coming out in their reverse orders (right-to-left, instead of left-to-right).
In filenames, the RLO character can be specifically positioned in the filename to spoof or masquerade as having a filename or file extension that is different than what it actually has. (Will still be hidden even if 'Hide extensions for known filetypes' is unchecked.)
The only info I can find that has info on how to prevent files with the RLO character from being run is from the Information Technology Promotion Agency, Japan website.
Can anyone recommend any other good solutions to prevent files with the RLO character in their names from being written or being read in the computer, or a way to alert the user if a file with the RLO character is detected?
My OS is Windows 7, but I'll be looking for solutions for Windows XP, Vista and 7, or a solution that will work for all those OSes, to help people using those OSes too.
1Very good question! I would like to know this too. Your link doesn't seem to work. – Cerberus – 2012-04-05T11:10:58.987
@Cerberus Just found out that the link doesn't work. I hope it's just temporarily down. I'll update the answer if I find a mirror. – galacticninja – 2012-04-05T13:11:42.360
http://webcache.googleusercontent.com/search?q=cache:KasmfOvbVJ8J:www.ipa.jp/security/english/virus/press/201110/E_PR201110.html+&cd=1&hl=en&ct=clnk – Cerberus – 2012-04-05T14:13:51.723
@Cerberus Thanks. I have added the mirror link to the question. – galacticninja – 2012-04-06T03:34:40.730
4
They adviced to use the Local Security Policy settings manager to block files with the RLO character in its name from being run.
Can you please tell us why this is not a solution? – Tamara Wijsman – 2012-04-21T09:33:52.033@TomWijsman I'm looking for other solutions that will prevent the RLO character from being written and read, or a solution that will notify or alert the user if the RLO character is detected. Also, maybe another user can provide a better solution. – galacticninja – 2012-04-21T12:57:01.587
@galacticninja: Detecting the RLO on your system is an easy script (just enumerate all file names and look if the character is there), even subscribing to I/O updates is still an easy task in a programming language. I still don't see how that would increase security over the ability of running the files... – Tamara Wijsman – 2012-04-21T13:01:35.047
@TomWijsman I'm looking for a more automated solution, one that will automatically detect it, in real-time, if the file containing the RLO character is encountered, rather than manually searching for the character. IMO, it's better to detect a potential malware as it is written, that when it is run. – galacticninja – 2012-04-21T13:07:37.813
This could be also by default from the site maker if it is created from the old marquee language option than it could be a problem of the typed code in the webpage option. – Naved – 2012-05-07T13:25:28.010