📸 Photo

KINGPIN

Internet Explorer recognizes that HTML Applications can be deadly and won’t execute them from the Web, only from the user’s hard drive. In theory.

In practice, Microsoft had left a hole in the way the browser screened content embedded on a Web page. Many Web pages contain OBJECT tags, which are simple instructions that tell the browser to grab something from another Web address—typically a movie or music file—and include it as part of the page. But it turned out you could also load an HTML Application through the OBJECT tag and get it to execute. You just had to disguise it a little.

While Max’s victims salivated over the bogus American Express dumps, an unseen OBJECT tag instructed their browsers to pull in a malicious HTML Application that Max had coded for the occasion. Crucially, Max had given the file a name ending in “.txt”—a superficial indication that it was an ordinary text file. Internet Explorer saw that file name and decided it was safe to run.

Once the browser started downloading the file, however, Max’s server transmitted a content type indicator of “application/hta”—identifying it now as an HTML Application. Essentially, Max’s server changed its story, presenting the file as a harmless document for the browser’s security check, then correctly identifying it as an HTML Application when it came time for the browser to decide how to interpret the file.

Having judged the file safe based on the name, Internet Explorer didn’t reevaluate that conclusion once it learned the truth. It just ran Max’s code as an HTML Application instead of a Web page.

Max’s HTML Application was a tight Visual Basic script that wrote out and executed a small grappling-hook program on the user’s machine. Max named the grappling hook “hope.exe.” Hope was Charity’s middle name.

The grappling hook, in turn, downloaded and installed his modified Bifrost Trojan horse. And just like that, Max was in control.