[gruez]

From the linked ESET blog post:

>It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm.

[noinsight]

Windows hiding file name extensions by default - the gift that keeps on giving. This wouldn't work (as easily) without that.

[vlovich123]

Mac and Gnome do too. I think somehow overlaying that it’s an executable and double-checking if you want to execute from a removable drive might be better techniques than worrying about file extensions which only help people who know what they’re doing already (in which case it’s common to configure the UI to show those extensions)

[masswerk]

Color coding any executables in file managers (in an otherwise reserved color) should be a standard.

[_dain_]

Colourblind employees would then become a spearphishing target.

[mafuy]

No. Colorblindness does not mean that one does not see any colors. There is only a tiny fraction of colorblind people who really cannot see any colors, and even they can still spot different luminances.

[munchler]

Allowing the user to run an executable directly off a USB drive seems like a very bad idea for an air-gapped computer. It's hard to imagine a scenario where this would be necessary.

[zahlman]

Copying the "folder" onto the local machine first wouldn't have helped, though. It would still be an executable, and the user would still be enticed to double-click it (because it would still appear to be a folder which the user expected to contain desired files). We could fall back to "allowing the user to use a GUI to select files seems like a very bad idea when they come from the other side of an air gap", but at some point a concession has to be made to usability.

The problems here are to do with how Windows uses and presents file extensions.

[worstspotgain]

Just spitballing of course, but if there was a 0-day at the USB stack level, there are many possible reasons why it wouldn't be mentioned here.

[stavros]

Oh wow, I didn't expect social engineering here...

[baxtr]

Would you define a fake icon as social engineering?

[stavros]

If it convinces a human to do something they wouldn't otherwise do, yes.