Serious Windows 10 flaw could corrupt your hard drive if you open a folder
A security researcher has revealed details of a strange bug that could result in an NTFS hard drive becoming corrupt in Windows 10, as well as the unsupported Windows XP. What makes the bug so serious and unusual is that it can be triggered without the user having to open a file.
The bug -- which has been shown to have been around for three years or so -- can cause a hard drive to be corrupted if a user simply views the contents of a folder that includes a specially crafted file. Although Microsoft is aware of the issue affecting the $i30 NTFS attribute, a fix has yet to be produced.
See also:
- Microsoft simplifies its Windows File Recovery app
- As of today, Adobe is blocking all Flash content from running
- WSL distros can now run Linux commands on startup in Windows 10
Writing on Twitter, security researcher Jonas L explains: "There is a specially nasty vulnerability in NTFS right now. Triggerable by opening special crafted name in any folder anywhere. The vulnerability will instant pop up complaining about your harddrive is corrupted when path is opened".
So how does the flaw work?
As Bleeping Computer explains -- complete with an appropriate warning -- running the command cd c:\:$i30:$bitmap will essentially destroy a drive (so don't do it!). But there are actually various ways in which hard drive corruption can be triggered; the most worrying is the method that simply requires someone to view folder contents. The vulnerability can be exploited even on user accounts that do not have administrator rights.
Jonas also found that if a shortcut file was created with its icon location set to C:\:$i30:$bitmap, merely opening the folder containing this file is enough to corrupt a drive. There are, of course, various ways in which such a malicious shortcuts could be implanted on a computer, and a user tricked into opening its containing folder.
Another security researcher, Siam Alam, demonstrated yet another way to trigger drive corruption:
Microsoft is currently working to produce a fix. In a statement given to the Verge, the company said: "We are aware of this issue and will provide an update in a future release. The use of this technique relies on social engineering and as always we encourage our customers to practice good computing habits online, including exercising caution when opening unknown files, or accepting file transfers".
Image credit: David Carillet / Shutterstock