Malware Hiding in a Fake System32 Directory Using NTFS Trailing-Space Trick | Hacker News Reader

Malware Hiding in a Fake System32 Directory Using NTFS Trailing-Space Trick

medium.com

3 pointsCriticalLY2 comments

I came across an interesting NTFS behavior where adding a trailing space in a Windows directory path creates a “ghost” folder that Explorer and most tools can’t display or access normally.

Attackers can abuse this to drop files inside what appears to be the real System32 directory, making the content extremely hard to notice.

I wrote a short breakdown with examples and behavior analysis.

At least, my Cygwin quickly complain there is sth wrong:

  % mkdir '//?/c:/test123 '
  % ls
  ls: test123 : No such file or directory

Still, ls work if test123 is shadowed.

  % ls -d test123*
  test123/  test123 /

But at least, you see it :)

Reply on news.ycombinator.com