This Word document file right here is not actually a Word document at all. And if you
clicked it, you would actually be running a potentially malicious executable file,
as you can see in the properties. And for you computer experts, hold on,
because I know you think you know what's going on here, but I guarantee you're wrong.
Some of you clever people may be saying, "Oh it's obvious. You just have file extensions hidden.
So the file must be called test.docx.exe, but the last part isn't showing." Alright,
so let's go and toggle on file extensions. And now we can see... Wait a minute, why
is the file extension still docx? And where did this "exe" in the middle of the name come from?
What type of voodoo magic is this? That's what I'll be explaining. And this is something I
very recently found out about myself, and I was shocked because it's a trick that I
legitimately may have fallen for easily if I ever encountered it. So definitely
pay attention. Alright, I'm not going to hold you in suspense any longer.
This trick uses a special invisible Unicode character called a right-to-left override,
or RTLO character. And it basically reverses any text that comes after it. I'll show you
how it works in a minute, but it's used for languages that are read from right to left.
And that lets you do some pretty funky stuff when it comes to file names and text in general.
Let me show you an example. To use this character, we can open the Character Map
program that is built into Windows. And then in the box that says Go to Unicode,
we can type in the code for this character, which is 202E. And you'll see immediately that
it jumped to it, and at the bottom left it has been identified as the right-to-left override.
Then we just hit select, then copy, and it is now in the clipboard. I should point out
though that there are several Unicode characters that cause this behavior,
and I'll just put all the codes of the ones I'm aware of here. Now let's open
Notepad and see how this works. So first I can just type without the special character.
It works as expected. But let's go to a new line, and I'll paste the character.
And it looks like nothing is there, but let's try typing out the alphabet. As you can see,
the most recent character you type actually gets put on the left. The
letter order is reversed. Though when the text is right-justified like this,
you may find it a little bit easier to understand and see how it works.
But now let's see what happens if I type something normally first, and then paste the character. Now
everything we type is still reversed, but only starting at the point that I pasted the RTLO
character. So all very cool, but here's the key. Even though to the user the text is displayed in
reverse, to the computer in the background, the text is still interpreted from left to right.
For example, if we go to save this text file and encode it with a limited character set that
does not include the RTLO character, such as ANSI. First you'll see it gives a warning that
there's a Unicode character that will be lost. And if we hit okay, now that RTLO character is
replaced with a question mark, and all the text appears in the order I actually had typed it.
And that's because that's how the information was being saved the whole time, just displayed
differently. So now you can probably start to see how this could be used to spoof a file's
extension. Though if you're wondering why the example file still had a Word document icon, I'll
get to that, hold on. So let's see what was going on with that first example file I showed you.
This time, let's go into the command prompt, and in the directory with that file,
we can use the "dir" command to list all the files. And now we
can see what was actually going on. The RTLO character is just shown as a question mark,
and we can see the real file name is "test" dot, then the RTLO character, then "xcod" dot "exe". So
if I were to actually type that out with the RTLO character working, it looks like this.
I should point out though that it's not necessary for there to be a second period here. I just put
it there to make it easier to see the real file extension. In the real world, it could look just
like this, a weird file name with a normal looking extension. And remember, the real file extension
will appear reversed, but that isn't as obvious here since exe is the same forward and backward.
By the way, one thing to note is that to get the command prompt to show it like this as a question
mark, you'll probably have to first change the command prompt to "legacy mode" in the settings
to limit the character set. Otherwise it won't show as a question mark, but still might reverse
the text. Also, even though all these examples are exe files, it isn't just limited to that.
This trick has been used in several real malware campaigns, sometimes with other file types,
such as .scr files, which are actually screensaver files that can be exploited
as malware, or also VBS scripts. Now, like I mentioned before, you may have noticed that
the icon on this file is like a Word document even though it's actually an executable file.
And that's because it's actually relatively simple to change the file icon of many different
file types to whatever you want. I won't get into all that for the sake of time, but you
can see here I changed this exe file icon to be an Xbox controller, just as an example. But you
can see how this could be used to not just spoof Word document files, but pretty much anything.
It could be a fake image extension, like JPEG, with an image icon, a PDF,
whatever. At this point, let's go over some ways you can spot this trick if you ever happen to
come across it. First, I still recommend you enable file extensions in Windows Explorer,
which is off by default. A malicious file may put a fake file extension without even using
the RTLO character, but if you don't have file extensions showing, you won't see it either way.
Now with file extensions enabled, you still have to be diligent for all the reasons we
just showed. And now more than ever, it should be obvious why it's extremely important to never run
or open any kind of suspicious files, no matter how benign they appear. But at least this way,
it'll make the trick possible to spot if you know what to look for.
If the trick is being used, the letters of the real file extension should still appear
somewhere in the file name, probably right before the fake file extension.
But for all I know at this point, there might be other weird Unicode characters
I don't know about that could hide other characters, or there might be in the future.
So don't take all of this as gospel. Still don't run anything suspicious. Anyway,
it's still important to remember a couple things. First, the real file
extension is going to be in reverse. With an exe file like in our examples,
that is easy because it's the same backwards. But if it's a VBS script, then it would show as SBV.
Also like I mentioned, I made these examples with an extra period here just to make it
easier to see, but that does not have to be like that. With file extensions enabled,
it might just look like this. So even though the file name is weird,
it wouldn't be so obvious that that's the real file extension.
And if viewing file extensions was turned off in Windows, the file could just look like this.
So yet again, it's another trick that really the main defense is simply knowing about it. Though
if any of you work in IT or security, it might be worth it to see if you can make a security policy
that will block any files from running that have one of these weird Unicode characters in them.
I can't think of a single legitimate use for a file having this in its name. I did try and look
up to see if there's an easy way for the average user on Windows Home or something to be able to
block this type of file, but I couldn't really find any, unfortunately. Still, at least now
you probably know about something that probably most computer experts have never even heard of.
If you enjoyed this video and found it helpful, definitely give the video a big
thumbs up for the YouTube algorithm. Let me know down in the comments if maybe you
are some kind of super genius that already did know about this, and let me know if you
maybe know about other really clever tricks like this that might be worth talking about.
And if you want to subscribe, I try to make videos about twice a week,
usually Wednesday and Saturday. If you want to keep watching,
the next video I'd recommend is one where I was talking about seven unexpected ways where you
can speed up your computer. So I'll put that link right here. Should be worth watching.
So thanks so much for watching, and I'll see you in the next one.