Explorer doesn't sniff anything with a known extension. Internet Explorer does.
<sigh> ...great logic; "let's trust the hidden contents of files
falling into the system from the Internet, so that hi-risk material
can pose as low-risk to the user and run hi-risk when 'opened' "
However it does some complicated thing of comparing what the server says it is,
what it sniffs, and what the extension is.
In the context of email attachments, there are three levels:
- what the MIME wrapper says it is
- what the extension says it is
- what it is
A safe OS would compare all of these for consistency, every time. If
there's a mis-match, it would be streetwise enough to suspect an
attack, and it would abort that content and alert.
In the context of files seen through the shell, again 3 levels:
- what the icon says it is
- what the extension says it is
- what it is
Again, "safety first" would mean treat files only as they are
described, and abort with alert if something tries to hide under the
wrong icon or extension. Here's how unbelievably wrong it goes...
- the most dangerous types can set any icon they like
- extensions are hidden by default
....are you with me so far? Yep, the user loses the ability to see
what type a file is, and thus has no way to predict impact.
But wait, it gets worse; even with extensions enabled, .PIF is never
shown. It gets worse still; if raw code is hidden in the .PIF itself,
it will be run as raw code when "opened", not as a true .PIF
Risk gradients can run in unexpected directions, so that even file
types that appear to be of similar level of risk, should be strictly
handled according to displayed type.
For example, when ways to run raw code through JPEG were discovered,
JPEG content within a nominally-hi-risk .EXE may be an issue.
For another example; when the seldom-used .WMF was found to be
attackable to run as raw code, it suddenly mattered that any .BMP,
..GIF, .JPG etc. could actually be WMF and "opened" as such.
We've known the benefits of strict type checking in programming
languages for some years (decades?) now. Time to bring that clue back
home to the world of files and file types.
--------------- ---- --- -- - - - -
"We have captured lightning and used
it to teach sand how to think."