The Mother of All Suspicious Files
The Mother of All Suspicious Files
[Browser download warning box containing the following text.] WARNING! This type of file can harm your computer! Are you sure you want to download: http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=__AUTOEXEC.BAT.MY%20OSX%20DOCUMENTS-INSTALL.EXE.RAR.INI.TAR.DOÇX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS_(1995)_BLURAY_CAM-XVID.EXE.TAR.[SCR].LISP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.H.SWF.DPKG.APP.ZIP.TAR.TAR.CO.GZ.A.OUT.EXE [Cancel and Save buttons (Save button disabled)]

The save dialog box shows a download from the address http://65.222.202.53 , an IP address that hosted JavaScript malware during a recent attack on the Tor anonymity network , with a very long file title. Many of the extensions used inside there indicate executable code; multiple file extensions are sometimes used to disguise a trojan program as a document.
You can also see common download syntax for a pirated movie, Hackers , likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. It is described as " _BLURAY_CAM ", which contradicts itself (" _BLURAY " would imply it was ripped from a copy on Blu-ray Disc , while " _CAM " would mean it was copied by pointing a camera at the screen in the cinema). " _BLURAY_CAM " would probably indicate a search-keyword-stuffed fake copy; fake pirated media often contain viruses (although this is more likely to be a problem with newer media, before the first real pirated copy appears).
The URL contains the path " ~tilde/pub/cia-bin/etc ". The first part is a public folder of a user named "tilde" (which is also the name for the ~ symbol ), " cgi-bin " is a common folder on a web server for server-side executables ( Randall changes the name to " cia -bin "), and " etc " is a standard folder for configuration files – normally never accessible through a web server. The program "init.dll" isn't executable at all, it's a Windows Dynamic Link Library which can't be run standalone, and is rarely referenced in URLs (even though such syntax is still being employed, even on reputable websites (Google search) or here at eBay , indicating the webserver is a Microsoft ASP server). The question mark indicates the start of a parameter list, and in this case we have only one named " FILE ".
The "Save" button is greyed out, suggesting that it is disabled; you can click only the "Cancel" button. For security reasons, some browsers (like Firefox) disable the "Save" button for a few seconds before enabling it. This prevents users from accidentally accepting a download while entering input, like a malicious CAPTCHA.
The complete content sent to the server, starting with " /~tilde... " and ending with " ...out.exe ", is exactly 256 characters long. On HTML 3 specifications you have a limitation of 1024 characters, whereas later HTML specifications don't have this limit; it just depends on the web server's capabilities. But posting parameters directly at the URL is still a worse choice.
The content of the parameter is shown here:
The title text suggests changing from http to https , as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. http (Hypertext Transfer Protocol) and https (Hypertext Transfer Protocol – Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. Changing http to https is a common suggestion to improve security when browsing the web from an insecure network (such as a public WiFi hotspot) to avoid surveillance or hijacking to a malicious website; Google automatically switches to https for all mail accounts and is starting to do so with searches. The end recipient will still get whatever nasties were in the original, however — encrypting it doesn't change the content at all.
The IP address referenced in the comic, 65.222.202.53 , was, at the time this article was authored, being used by the shellcode of a JavaScript zero-day exploit for the Tor Browser Bundle being run by the FBI to phone home over the clearnet [1] and deanonymize visitors to websites on Freedom Hosting that are serving child pornography. [2]
As the last extension in the file is .exe, a Windows computer would run the file like an application. Usually, it is not safe to run unknown .exe files.
[Browser download warning box containing the following text.] WARNING! This type of file can harm your computer! Are you sure you want to download: http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=__AUTOEXEC.BAT.MY%20OSX%20DOCUMENTS-INSTALL.EXE.RAR.INI.TAR.DOÇX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS_(1995)_BLURAY_CAM-XVID.EXE.TAR.[SCR].LISP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.H.SWF.DPKG.APP.ZIP.TAR.TAR.CO.GZ.A.OUT.EXE [Cancel and Save buttons (Save button disabled)]
