Jonas L on Twitter: "if nothing found there- look in \GLOBAL?? there we find a symlink named GLOBALROOT… "

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Nice find by @jonasLyk : cd <specialdir> Result: NTFS corruption Other vectors: - Open an ISO, VHD, or VHDX - Extract a ZIP file - Open an HTML file without a MoTW - Probably more...pic.twitter.com/LY18Lo3J3m

7 replies 37 retweets 93 likes

Show this thread

Will Dormann‏ @wdormann Jan 9

This problem seems to be introduced around the time of Windows 10 1803. Prior versions of Windows do not appear to be affected. I'll give Microsoft a shot at addressing this before disclosing what the value of <specialdir> is. Though I question how such things get prioritized...

4 replies 5 retweets 35 likes

Show this thread

Will Dormann‏ @wdormann Jan 9

Will Dormann Retweeted Will Dormann

Why? Almost 2 years ago I reported to them NTFS filesystems that can cause windows to BSOD when they're mounted. e.g. by double-clicking a VHD or VHDX file. That's still not fixed.https://twitter.com/wdormann/status/1095799927765127170 …

Will Dormann added,

Will Dormann @wdormann

Inspired by my earlier accidental discovery that a FreeNAS 11.2 ISO written to a USB drive with Rufus will cause Windows 7 to BSOD, I got to wondering how well modern operating systems handle malformed filesystems. Windows, Linux, macOS, FreeBSD all fail. https://www.youtube.com/watch?v=r3MeifE2oFw …

Show this thread

3 replies 9 retweets 44 likes

Show this thread

Will Dormann‏ @wdormann Jan 16

And since the cat it is out of the bag: https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/ … It's probably worth mentioning that browsing the internet with old Edge browser could lead to NTFS corruption. It will happily allow a page on the internet to reference a local path. Don't use that Edge version.

1 reply 10 retweets 23 likes

Show this thread

Will Dormann‏ @wdormann Jan 16

I've not seen another modern browser that allows a page that lives on the internet to be able to directly access a local file resource. But "classic" (non-Chromium) Edge? YOLO!pic.twitter.com/PvMz3PkakX

1 reply 4 retweets 19 likes

Show this thread

Will Dormann‏ @wdormann Jan 16

Compare this vs. the Chromium-based Edge, or just about any other browser. A page on the internet can't just directly access a file on your local filesystem. Because this is dangerous.pic.twitter.com/5FWee5tqNd

2 replies 0 retweets 11 likes

Show this thread

Will Dormann‏ @wdormann Jan 17

And while I haven't seen a variant that can trigger it directly from a (legacy) Edge browser on an internet page, it's worth mentioning that there's a vaguely-related (badness via accessing a path) BSOD bug released recently:https://www.bleepingcomputer.com/news/security/windows-10-bug-causes-a-bsod-crash-when-opening-a-certain-path/ …

1 reply 0 retweets 3 likes

Show this thread

Will Dormann‏ @wdormann Jan 18

Specifically, I didn't see a way to get legacy Edge to obey the '.' in \\.\globalroot\device\condrv\kernelconnect However, as with the NTFS corruption bug, this can be triggered by something as innocuous as opening a file from a website. e.g., an ISO file:pic.twitter.com/AQL7Flfpk6

2 replies 1 retweet 7 likes

Show this thread

Jonas L‏ @jonasLyk Jan 18

Replying to @wdormann

The way it works is: \\.\ or \\?\ or \??\ will start by looking in the callers local devicemappic.twitter.com/xBkouKg9wZ

2 replies 1 retweet 3 likes

Jonas L‏ @jonasLyk Jan 18

Replying to @jonasLyk @wdormann

if nothing found there- look in \GLOBAL?? there we find a symlink named GLOBALROOTpic.twitter.com/CEbruD2Plz

8:27 AM - 18 Jan 2021

1 Like

2 replies 0 retweets 1 like

1. Show replies
1. Show replies

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

Tweets

Jonas L

@jonasLyk

Tweets

Loading seems to be taking a while.

false

Saved searches

Tweets

Jonas L

@jonasLyk

Tweets

Go to a person's profile

Saved searches

Promote this Tweet

Block

Tweet with a location

Your lists

Create a new list

Copy link to Tweet

Embed this Tweet

Embed this Video

Preview

Why you're seeing this ad

Log in to Twitter

Sign up for Twitter

Not on Twitter? Sign up, tune into the things you care about, and get updates as they happen.

Two-way (sending and receiving) short codes:

Confirmation

Welcome home!

Tweets not working for you?

Say a lot with a little

Spread the word

Join the conversation

Learn the latest

Get more of what you love

Find what's happening

Never miss a Moment

Loading seems to be taking a while.

Promoted Tweet

false