5. Other security measures
There are a number of other measures you can take to enhance the security of your computer. One of the most effective is to change the way that Windows displays filenames.
When MS-DOS was first introduced by Microsoft filenames were limited to uppercase characters only and consisted of a name, of up to 8 characters, followed by a period, followed by a type (or extension) of up to 3 characters. Because of this such filenames are known in the IT industry as 8.3 filenames. The extension was used to denote what the file was used for, a file containing text would be given the extension .TXT, programs initially had extensions .COM because they were known as commands and later a different type of program was given the extension .EXE.
This practice continues to this day, although it's now possible to give files names longer than 8 characters. (As a matter of interest Microsoft Operating Systems are still case insensitive when ir comes to file names, which means you cannot have the files "FILE.TXT" and "file.txt" in the same folder, Windows considers both file name to be the same.)
Nowadays Windows doesn't rely on the file extension, more sophisticated measures are used to determine what the actual file contents are but by default Windows hides the extension for files with known filetypes. So the file "XmasList.doc" will be displayed by Windows as simply "XmasList".
It was intended that the icon associated with the filetype to indicate to the user what the file is intended for, but this can be circumvented for nefarious means.
An attacker could entice you to download a file, or send one by email, and disguise the file in the following manner.
- The file is an executable, say with the name "LetterFromMum.exe", but Windows displays the filename simply as "LetterFromMum".
- For executable files (such as .EXEs) the icon to display is stored within the executable file itself, and the attacker has chosen to use the same icon as used for text files.
- So you see "LetterFromMum" displayed with a text icon and double-click it, expecting it to open in Notepad. Instead, Windows launches the executable which may contain a virus or other malware.
We want to make sure that Windows displays the full filename for all files, so we'll see "LetterFromMum.exe" and know that this file is not a text file.
Here's the procedure :
- Open Windows Explorer from Start Menu → All Programs → Accessories → Windows Explorer
- In Windows Explorer select Tools → Folder Options...
- in the Folder Options dialog, select the View tab and clear the checkbox next to Hide extensions for known file types, then click OK.
You can now close Windows Explorer and full filenames will be shown. This setting applies to the Desktop, to Windows Explorer and to the Windows Open/Save dialogs.
- Login to post comments
