Title: Windows File Pseudonyms
Speaker: Dan Crowley
Date: February 5, 2010
Location: Washington, DC
Link to event: http://www.shmoocon.org/
Overview:
In Windows systems, path and filename normalization routines have some interesting quirks. One file can be referred to with many different file paths and names, some well known, and some not so well known. The lesser known ways to refer to files are not often considered when designing security mechanisms. By referring to files in these strange ways, one can, in many circumstances, cause unexpected behavior in systems which do not account for these aliases. These quirks can be used to bypass filters and access control mechanisms, evade IDS detection, reduce entropy when attempting to enumerate filenames by brute-force, and alter the way that files are handled and processed. In this paper, four different quirks about windows files and paths will be discussed: 8.3 aliases; characters which, when appended to file names, are completely ignored; DOS special devices and their personal quirks; and namespace prefixes.
