Hacker News Reader

Comment by jlv2 | Hacker News Reader

"The sample received in our lab was vbs script which has multiple embedded js scripts. On execution, it creates a directory “GFp0JAk” at location “%userprofile%\AppData\Local\”."

Why is this even possible?

View on HN

If applications can't write to the Application Data folder then what's the point of an application data folder?

> Why is this even possible?

Well they said "on execution" so that's what made it possible. Now if it could install to that location without being explicitly executed (say on download or via a browser bug) then THAT would be a much bigger deal.

It's not so much the "applications can write data to application data" as it is "application data is executable by default". It's simply a design choice from before security was important. Nobody would defend that design today and Microsoft recognized this when they created appx which separates installers, executable programs, and data into separate content types treated with separate security policy.

Can't everybody write to their own user's AppData folder?

Yes, but it's not granular per-application [i believe]. On an install script you can create folders in %localappdata% without needing elevated permissions meaning that %localappdata% and any files/folders you create are owned by the current user; unless a script does something with the file permissions, any other application can scan, access, and modify other applications (same goes for all of your user files but that's just par for the course for win32).

Reply on news.ycombinator.com