New Web vulnerability enables powerful social engineering attacks

Users who are careful to download files only from trusted websites may be tricked by a new type of Web vulnerability: this one cons them into downloading malicious executable files that are not actually hosted where they appear to be.

The attack has been dubbed reflected file download (RFD) and is somewhat similar in concept to reflected cross-site scripting (XSS) attacks where users are tricked to click on specifically crafted links to legitimate sites that force their browsers to execute rogue code contained in the URLs themselves.

In the case of RFD, the victim’s browser does not execute code, but offers a file for download with an executable extension like .bat or .cmd that contains shell commands or script files like JS, VBS, WSH that will be executed through the Windows-based script host (Wscript.exe). The contents of the file are passed through the attacker-generated URL that the user clicks on, the website reflecting the input back to the browser as a file download.

To read this article in full or to leave a comment, please click here