If you think the only types of files you need to watch out for are .exes and .zip files,
think again, because there are tons of file types out there that hackers can and do use,
simply because people aren't familiar with them. So that's what I'm going to be focusing
on in this video, starting out with some of the more common ones to watch out for that you might
not be familiar with already, and then some of the less common ones that you still should know about.
Though in this video, I'm going to be focusing on Windows specifically. And later on,
I'm also going to give you a tip on how to prevent yourself from accidentally running
certain script files when I talk about those. So be sure to stick around. Oh,
and if you haven't already, I always recommend everyone set Windows to always
show file extensions, just so you can always know what kind of file you're dealing with.
And you can do this by going into the Windows Explorer and then [Options],
and then look for the checkbox for Hide Known File Extensions and just uncheck
that. And you'll see why that's really important in a bit, but at this point,
let's just jump in. First, for some important context, I'm going to go
over five major categories of file types that I believe would possibly be used maliciously.
And this is going to make it easier to understand the individual file types I
explain later. Some of this might get a bit technical, so I'll try to limit that,
but don't worry if you don't understand some of this at all. All right, the first category
are executables. And by executable, I do not just mean files that you can double click on and run.
Technically, it's more specific, and this will become more relevant when I talk about other
file types as a contrast. But basically, with an executable file, they themselves
execute code and can be run directly. And of course, an example of these are an .exe file,
but there's more I'll go over later. The next category of files are library files.
And these actually are structurally very similar to executables and actually do
contain executable code. But with library files, there's one major difference,
which is they aren't run by themselves, like as their own process. They get called by another
process, and the library contains general use functions that lots of programs can utilize.
But it's not like you can just run the DLL because it doesn't have like a main
function to run. You have to specifically say which one within it to run. Next up,
we have script files, which also technically don't get run by themselves, even though there
are some that you can double click and run just like you would an .exe, such as a batch file.
With script files, they're actually run by another program that's probably built
into the OS. It might be called a shell or a script host. And one major difference between
a script and the previous things we talked about, are scripts will be human readable,
meaning if you open it up with Notepad, you can actually look at the actual code inside there.
Now moving on, the next category is a bit more general, and that is files or
documents that open up in a program that allow executing code, such as macros. For example,
you may know that Microsoft Office files can contain script code, such as macros that can
actually do a lot on your computer. And if you open it in Microsoft Word or Excel and
allow that script code to run, it could be just as bad as running a malicious executable file.
The final category are archive files, which can actually just contain any type
of other file. So you really need to be aware of these. Fortunately,
the most common one that's almost always used is zip files, but there are just a
couple others that I'll go over in a bit. Now, before moving on to all the specific file types,
I can tell you about another way to protect yourself against malware and scams.
Today's sponsor, Bitdefender, and their product, Bitdefender Total Security. It's more than just
an antivirus program, but a complete security suite. It has a wide array of protection features,
such as network threat prevention, which can stop attacks before they begin by
blocking malicious attempts on system vulnerabilities and brute force attacks.
It can even protect against new malware by analyzing their behavior, not just relying
on signatures, though of course it can detect them that way too. At this point, it's probably
clear to everyone that hackers and scammers are getting really clever, and not just when
it comes to malware either. You've got phishing, fraudulent scam sites, even obnoxious spam emails.
But Bitdefender Total Security can handle all those things while
protecting you online. It does anti-phishing to block websites that steal your passwords,
or even credit card info. It also has an advanced filtering system
to detect fraud and warn you whenever you visit websites that may try to scam you.
There were $8 billion lost to internet fraud in 2022 alone, and you might be surprised
that 34% of young adults are more likely to get scammed than people over 60. Because sometimes,
common sense just isn't enough. All it takes is one slip up. So definitely
visit the link in the description to check out Bitdefender Total Security.
And with all that being said, let's continue on to those specific file types to watch out
for. Just remember that this is not going to be a complete exhaustive list. There's
tons of techniques hackers are coming up with every day, but it should cover a lot. And also,
just because you see some of these files, it doesn't mean they're malicious.
They all are going to have both legitimate and malicious uses. Starting off with executables,
there's actually a ton of different types of these. However, I would just focus on a few,
which are the ones that Windows will let you run by default by just double clicking it. The
most common executables used by hackers are going to have these file extensions.
You're probably already familiar with EXEs, but another big one are SCR files,
screen saver files. And these are actually executables, basically the same as an EXE,
but hackers use them for two reasons. One, not a lot of people are familiar with them,
so they don't realize it's as risky as running an EXE.
And with a screen saver file, you can change the icon just like you could with an EXE,
so they can make it look like a document or another type of file. Then the other common ones
are going to be .com and .msi. MSI is an installer file for programs. And even though you might not
technically consider an MSI an executable, it can contain arbitrary code called a Custom Action.
So it could be just as dangerous as an EXE. And then there are a couple others to watch out for
that are probably less common, but still possible, which are CPL and MSP files. Moving on to script
files, there's actually quite a few that can be run in Windows by default by just double clicking
them. And this is a list of what I believe are all those that can be just double clicked.
You have BAT and CMD files. These basically run command prompt commands. You may already
know about batch files, but a CMD file is pretty much the same thing. But also
there's these other types that are mostly related to JavaScript and Visual Basic,
VBS scripts. So you have .js, that's an actual JavaScript file.
WSF, VBS, that's a VBS file. But these other ones, JSE, VBE, WSH,
and SCT can also just be run by clicking on them. However, here is a tip you can use to
prevent yourself from accidentally clicking and running these files. Unfortunately,
I don't believe it works for BAT and CMD files, but it should work with the rest.
And what you do is just make files with these extensions. They can be totally empty. You
just hit Right Click, New, and change the file extension. And then for each one, you're going
to right click and hit "Open With", and then hit "choose a program", and then go to Notepad, select
that and hit "always". Also, this might look a bit different on Windows 10, but it's the same idea.
And then you're just going to go and do that for all the other file types. And now if you
click on these instead of running, it will actually open in notepad. Now this doesn't
necessarily make them completely benign because they can still be run by other
programs like command prompt or office, and it'll still actually run the script.
But this is just to prevent you from accidentally clicking on them. Finally,
you should be aware of PowerShell scripts. These are usually going
to be .ps1 and .psm1. Now usually these aren't ones that you have to worry about
being able to click and run. You usually have to go into the actual command line to do it.
However, you should still be aware of them because a virus could include that as its payload,
and then run it and use that to infect the rest of the system. So still be wary
if you see them in something you downloaded. But again, there are some legitimate uses,
just be on guard with them. And that actually kind of ties into the next file type I want to
talk about, which I wouldn't really put in a category, but shortcuts.
Yes, a regular shortcut in Windows can potentially be used maliciously. Technically
these are .LNK files link. However, it's not going to show in Windows this file extension
even if you have file extensions showing. To do that, you have to go into the registry,
but usually it shows that little shortcut icon. And be aware that running one of these could,
for example, run a Command Prompt command, like you can see here.
I made it so it opens up Command Prompt window and just says this text,
but it could be used for example, to run another malicious file that could be included. And this
is actually something that hackers have done where they'll have a zip file or
something where it'll just have the shortcut with "Attachment" as the name, and then some
hidden DLL files, and the DLL files get run by a command that gets run by the shortcut.
And that's the reason I also wanted to be sure to talk about library files like a DLL, but there's
also other ones. Usually it's going to be .drv and .sys. Again, even though with library files,
if you double click them, it's probably not going to do anything, like you just saw,
they could still use something like a shortcut to still use it maliciously.
All right, next up we have archives, which are a favorite used by hackers,
especially zip files, which are by far the most common simply because hackers know that people
are familiar with them. They open zip files all day, so it's the easiest to use. However,
zip files also have some features and properties that also make it very attractive to hackers.
One of them is the ability to password protect and encrypt,
where this is going to allow them to oftentimes get by virus scanners. They may send the virus in
a password protected zip file and say, "Oh, it's just for security purposes. Here's the password",
and send that along with the email. And then that'll prevent email antivirus scanners from
catching it until it's actually on the computer.
And by then the person might open it up and run the virus. Now,
a couple other archive formats most people are not familiar with are ISO and IMG or
image files. And these are actually disk image files. You can literally
right click and mount these and it'll show up as a virtual disk on your computer.
And in recent years, hackers have been using these more and more. So if you see this type of file,
just be aware of it, especially if it comes as an attachment, that is not usual at all. Finally,
probably the other default type of archive you'll see is a cabinet file. Although I think this is
relatively uncommon for malware, but still it's an archive you got to watch out for.
And now finally, we can talk about office document files. You may already know that a lot of these
can be malicious, like a PDF file can contain scripting and be used just like a virus. But like
I mentioned before, other Microsoft Office files can also contain macros and scripts.
So you probably already know these. They're .docx, .xlsx for Excel and PowerPoint PPTX.
However, there are a couple other ones that are less common that you might not be aware of,
which are .docm, .xlsm and .pptm. And these are actually macro enabled documents
for Microsoft Office. And there's also these file types for templates for the Office apps.
Though apparently only these file extensions with the M are ones that can store macros,
but you should still be cautious even with the regular document files, because they could
potentially have embedded objects that could be malicious or they'll figure something else out.
Another thing I definitely want to point out, if you use Adobe Reader as your default PDF reader,
there is definitely a security setting that you should enable. If you go into
the preferences and then "Security (Enhanced)", look for the setting that says "Protected View"
and set that to "All Files". This way it will not run scripts and stuff by default.
And you'll see when you open a PDF, it'll have a protected view thing and you'll have to click
to enable all content, but you should be not clicking that for files that you are
not a hundred percent certain are safe. I don't know why that's not always enabled by default,
but definitely use that. Now I should point out that a little while ago,
Microsoft did make a change to their Office programs where by default,
it disables macros on files that came from the internet or were downloaded.
And that's because Windows, if you download a file, it adds a hidden
piece of information attached to the file. It's called the "mark of the web". However,
you still need to be extremely cautious with these files because of zip files,
especially. Remember I talked about the other features that hackers like?
One of them, I guess, is not actually really a feature, but zip files do not support that extra
data, the mark of the web. So if a hacker sends a zip file containing a document with macro that's
malicious in there and the person extracts it, it's not going to have that mark. So Windows won't
necessarily know that it came from the internet and that's going to make it a lot more dangerous.
Now, I still do believe that Office programs don't execute the macros, even if it's not completely
disabled in the program, but that's still a hurdle that hackers are able to get by. And I guess the
final catch-all advice to give is, of course, if you do not recognize a file extension and you're
not sure what it does, do not run it, or really do your research and figure out what it is and
who it is that is sending that type of file, and does it match up with what they're saying it is.
But at least now with the ones I talked about, you might remember them if the time comes and
know to watch out for it. So hopefully you enjoyed this video and now you're a
bit more secure than you were before. Thanks again to Bitdefender for sponsoring. Again,
be sure to check out the link in the description to protect yourself against all sorts of malware,
scams, and fraud with Bitdefender Total Security.
If you did enjoy this video, definitely give it a big giant thumbs up for the YouTube
algorithm. And if you want to subscribe, I try to make videos about twice a week,
usually Wednesday and Saturday. If you want to keep watching, the next video I'd recommend is
where I was talking about those ISO files and shortcut files that hackers have been using.
You can see how that works right here,
you can click on. So thanks so much for watching and I'll see you in the next one.