explain xkcd - User contributions [en]

1247: The Mother of All Suspicious Files

2013-08-05T15:05:09Z

Ronf89: /* Explanation */

{{comic
| number = 1247
| date = August 5, 2013
| title = The Mother of All Suspicious Files
| image = the_mother_of_all_suspicious_files.png
| titletext = Better change the URL to 'https' before downloading.
}}

==Explanation==
The save dialogues shows a download from [http://www.utrace.de/?query=65.222.202.53 65.222.202.53] with a very long file title. Many of the extensions used inside there indicate executable code. You also see common download syntax for a pirated movie, Hackers, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. The ".LNK" extension is the windows extension for a shortcut (the extension is normally hidden to the user), whereas ".LNK.ZDA.GNN" extensions are references to Link, Zelda, and Ganon, important characters from the Legend of Zelda video game franchise.

The file seems to be an executable, but other file types referenced include:
* AUTOEXEC.BAT - which is automatically run during startup on Windows/DOS operating systems.
* MY%20OSX%20DOCUMENTS - referencing the OSX operating system (%20 is a representation of a space in a URL, i.e. it reads as "MY OSX DOCUMENTS").
* INSTALL.EXE - a typical installer
* RAR - a compressed archive file type
* INI - a settings file type
* TAR - a concatenated file type
* DOÇX - looks like a Microsoft Word file type, but isn't
* PHPHPHP - a play on PHP files, a kind of server-based web page file type
* XHTML - another web page file type
* TML - stands for Transducer Markup Language, an XML based markup language that specifies how to capture, time-tag and describe sensor data
* XTL - another play on XHTML?
* TXXT - a play on TXT file types
* 0DAY - a reference to a zero-day exploit
* HACK.ERS_(1995)_BLURAY_CAM-XVID - a reference to the 1995 Hackers movie, but pirated movies would either be a BlurayRIP/DVDRIP or CAM, but not both at the same time unless you used a camera to recored the Blueray movie as it played?
* EXE - an executable file type
* [SCR] - a Windows screensaver
* LISP - the programming language [https://en.wikipedia.org/wiki/Lisp_(programming_language)]
* MSI - an installer file type
* WRBT - ???
* OBJ - a universal 3D modeling file format
* O - The extension for a linker file, an intermediary created when compiling C code.
* H - The file extension of a header file in C code.
* SWF - Shockwave Flash file type
* DPKG - Debian package file type
* APP - an application on Mac OS X operating system
* ZIP - compressed archive file type
* CO.GZ - looks like a [http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains top-level domain] for an unknown country but isn't
* A.OUT - Default filename when creating an executable on linux with gcc [http://www.cprogramming.com/gcc.html]

The title text suggests changing from http to https, as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. http (Hyper Text Transfer Protocol) and https (Hyper Text Transfer Protocol - Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. The end recipient will still get whatever nasties were in the original, however - encrypting it doesn't change the content at all.

The IP address referenced in the comic, 65.222.202.53, is currently being used by the shellcode of a Javascript 0-day exploit for the Tor Browser Bundle being run by the FBI to phone home over the clearnet and de-anonymize visitors to websites on Freedom Hosting that are serving child pornography. [http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/]

==Transcript==
:[A save dialogue popup with an alert sign.]
:Warning!
:This type of file can harm your computer! Are your sure you want to download: <nowiki>http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=--AUTOEXEX.BAT.MY%20OSX%20DOCUMENTS-INSTANLL.EXE.RAR.INI.TAR.DOCX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS_(1995)_BLURAY-CAM_XVID.EXE.TAR.[SCR].LISTP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.SWF.DPKG.APP.ZIP.TAR.CO.GZ.OUT.EXE</nowiki>

:[Two buttons:]
:Cancel Save

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

1247: The Mother of All Suspicious Files

2013-08-05T15:00:09Z

Ronf89: /* Explanation */

{{comic
| number = 1247
| date = August 5, 2013
| title = The Mother of All Suspicious Files
| image = the_mother_of_all_suspicious_files.png
| titletext = Better change the URL to 'https' before downloading.
}}

==Explanation==
The save dialogues shows a download from [http://www.utrace.de/?query=65.222.202.53 65.222.202.53] with a very long file title. Many of the extensions used inside there indicate executable code. You also see common download syntax for a pirated movie, Hackers, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. The ".LNK" extension is the windows extension for a shortcut (the extension is normally hidden to the user), whereas ".LNK.ZDA.GNN" extensions are references to Link, Zelda, and Ganon, important characters from the Legend of Zelda video game franchise.

The file seems to be an executable, but other file types referenced include:
* AUTOEXEC.BAT - which is automatically run during startup on Windows/DOS operating systems.
* MY%20OSX%20DOCUMENTS - referencing the OSX operating system (%20 is a representation of a space in a URL, i.e. it reads as "MY OSX DOCUMENTS").
* INSTALL.EXE - a typical installer
* RAR - a compressed archive file type
* INI - a settings file type
* TAR - a concatenated file type
* DOÇX - looks like a Microsoft Word file type, but isn't
* PHPHPHP - a play on PHP files, a kind of web page file type
* XHTML - another web page file type
* TML - possibly a compromise between xhtml, html, shtml, etc?
* XTL - another play on XHTML?
* TXXT - a play on TXT file types
* 0DAY - a reference to a zero-day exploit
* HACK.ERS_(1995)_BLURAY_CAM-XVID - a reference to the 1995 Hackers movie, but pirated movies would either be a BlurayRIP/DVDRIP or CAM, but not both at the same time unless you used a camera to recored the Blueray movie as it played?
* EXE - an executable file type
* [SRC] - a source file
* LISP - the programming language [https://en.wikipedia.org/wiki/Lisp_(programming_language)]
* MSI - an installer file type
* WRBT - ???
* OBJ - a universal 3D modeling file format
* O - The extension for a linker file, an intermediary created when compiling C code.
* H - The file extension of a header file in C code.
* SWF - Shockwave Flash file type
* DPKG - Debian package file type
* APP - an application on Mac OS X operating system
* ZIP - compressed archive file type
* CO.GZ - looks like a [http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains top-level domain] for an unknown country but isn't
* A.OUT - Default filename when creating an executable on linux with gcc [http://www.cprogramming.com/gcc.html]

The title text suggests changing from http to https, as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. http (Hyper Text Transfer Protocol) and https (Hyper Text Transfer Protocol - Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. The end recipient will still get whatever nasties were in the original, however - encrypting it doesn't change the content at all.

The IP address referenced in the comic, 65.222.202.53, is currently being used by the shellcode of a Javascript 0-day exploit for the Tor Browser Bundle being run by the FBI to phone home over the clearnet and de-anonymize visitors to websites on Freedom Hosting that are serving child pornography. [http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/]

==Transcript==
:[A save dialogue popup with an alert sign.]
:Warning!
:This type of file can harm your computer! Are your sure you want to download: <nowiki>http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=--AUTOEXEX.BAT.MY%20OSX%20DOCUMENTS-INSTANLL.EXE.RAR.INI.TAR.DOCX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS-(1995)-BLURAY-CAM_XVID.EXE.TAR.[SCR].LISTP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.SWF.DPKG.APP.ZIP.TAR.CO.GZ.OUT.EXE</nowiki>

:[Two buttons:]
:Cancel Save

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

1247: The Mother of All Suspicious Files

2013-08-05T14:55:21Z

Ronf89: /* Explanation */

{{comic
| number = 1247
| date = August 5, 2013
| title = The Mother of All Suspicious Files
| image = the_mother_of_all_suspicious_files.png
| titletext = Better change the URL to 'https' before downloading.
}}

==Explanation==
The save dialogues shows a download from [http://www.utrace.de/?query=65.222.202.53 65.222.202.53] with a very long file title. Many of the extensions used inside there indicate executable code. You also see common download syntax for a pirated movie, Hackers, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. The ".LNK.ZDA.GNN" extensions are references to Link, Zelda, and Ganon, important characters from the Legend of Zelda video game franchise.

The file seems to be an executable, but other file types referenced include:
* AUTOEXEC.BAT - which is automatically run during startup on Windows/DOS operating systems.
* MY%20OSX%20DOCUMENTS - referencing the OSX operating system (%20 is a representation of a space in a URL, i.e. it reads as "MY OSX DOCUMENTS").
* INSTALL.EXE - a typical installer
* RAR - a compressed archive file type
* INI - a settings file type
* TAR - a concatenated file type
* DOÇX - looks like a Microsoft Word file type, but isn't
* PHPHPHP - a play on PHP files, a kind of web page file type
* XHTML - another web page file type
* TML - possibly a compromise between xhtml, html, shtml, etc?
* XTL - another play on XHTML?
* TXXT - a play on TXT file types
* 0DAY - a reference to a zero-day exploit
* HACK.ERS_(1995)_BLURAY_CAM-XVID - a reference to the 1995 Hackers movie, but pirated movies would either be a BlurayRIP/DVDRIP or CAM, but not both at the same time unless you used a camera to recored the Blueray movie as it played?
* EXE - an executable file type
* [SRC] - a source file
* LISP - the programming language
* MSI - an installer file type
* WRBT - ???
* OBJ - a universal 3D modeling file format
* O.H - ???
* SWF - Shockwave Flash file type
* DPKG - Debian package file type
* APP - generic application file type?
* ZIP - compressed archive file type
* CO.GZ - looks like a [[http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains top-level domain]] for an unknown country but isn't
* A.OUT - Default filename when creating an executable on linux with gcc [http://www.cprogramming.com/gcc.html]

The title text suggests changing from http to https, as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. http (Hyper Text Transfer Protocol) and https (Hyper Text Transfer Protocol - Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. The end recipient will still get whatever nasties were in the original, however - encrypting it doesn't change the content at all.

The IP address referenced in the comic, 65.222.202.53, is currently being used by the shellcode of a Javascript 0-day exploit for the Tor Browser Bundle being run by the FBI to phone home over the clearnet and de-anonymize visitors to websites on Freedom Hosting that are serving child pornography. [http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/]

==Transcript==
:[A save dialogue popup with an alert sign.]
:Warning!
:This type of file can harm your computer! Are your sure you want to download: <nowiki>http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=--AUTOEXEX.BAT.MY%20OSX%20DOCUMENTS-INSTANLL.EXE.RAR.INI.TAR.DOCX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS-(1995)-BLURAY-CAM_XVID.EXE.TAR.[SCR].LISTP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.SWF.DPKG.APP.ZIP.TAR.CO.GZ.OUT.EXE</nowiki>

:[Two buttons:]
:Cancel Save

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]

1247: The Mother of All Suspicious Files

2013-08-05T14:53:41Z

Ronf89: /* Explanation */

{{comic
| number = 1247
| date = August 5, 2013
| title = The Mother of All Suspicious Files
| image = the_mother_of_all_suspicious_files.png
| titletext = Better change the URL to 'https' before downloading.
}}

==Explanation==
The save dialogues shows a download from [http://www.utrace.de/?query=65.222.202.53 65.222.202.53] with a very long file title. Many of the extensions used inside there indicate executable code. You also see common download syntax for a pirated movie, Hackers, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. The ".LNK.ZDA.GNN" extensions are references to Link, Zelda, and Ganon, important characters from the Legend of Zelda video game franchise.

The file seems to be an executable, but other file types referenced include:
* AUTOEXEC.BAT - which is automatically run during startup on Windows/DOS operating systems.
* MY%20OSX%20DOCUMENTES - referencing the OSX operating system.
* INSTALL.EXE - a typical installer
* RAR - a compressed archive file type
* INI - a settings file type
* TAR - a concatenated file type
* DOÇX - looks like a Microsoft Word file type, but isn't
* PHPHPHP - a play on PHP files, a kind of web page file type
* XHTML - another web page file type
* TML - possibly a compromise between xhtml, html, shtml, etc?
* XTL - another play on XHTML?
* TXXT - a play on TXT file types
* 0DAY - a reference to a zero-day exploit
* HACK.ERS_(1995)_BLURAY_CAM-XVID - a reference to the 1995 Hackers movie, but pirated movies would either be a BlurayRIP/DVDRIP or CAM, but not both at the same time unless you used a camera to recored the Blueray movie as it played?
* EXE - an executable file type
* [SRC] - a source file
* LISP - the programming language
* MSI - an installer file type
* WRBT - ???
* OBJ - An universal 3D modeling file format
* O.H - ???
* SWF - Shockwave Flash file type
* DPKG - Debian package file type
* APP - generic application file type?
* ZIP - compressed archive file type
* CO.GZ - looks like a [[http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains top-level domain]] for an unknown country but isn't
* A.OUT - Default filename when creating an executable on linux with gcc [http://www.cprogramming.com/gcc.html]

The title text suggests changing from http to https, as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. http (Hyper Text Transfer Protocol) and https (Hyper Text Transfer Protocol - Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. The end recipient will still get whatever nasties were in the original, however - encrypting it doesn't change the content at all.

The IP address referenced in the comic, 65.222.202.53, is currently being used by the shellcode of a Javascript 0-day exploit for the Tor Browser Bundle being run by the FBI to phone home over the clearnet and de-anonymize visitors to websites on Freedom Hosting that are serving child pornography. [http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/]

==Transcript==
:[A save dialogue popup with an alert sign.]
:Warning!
:This type of file can harm your computer! Are your sure you want to download: <nowiki>http://65.222.202.53/~TILDE/PUB/CIA-BIN/ETC/INIT.DLL?FILE=--AUTOEXEX.BAT.MY%20OSX%20DOCUMENTS-INSTANLL.EXE.RAR.INI.TAR.DOCX.PHPHPHP.XHTML.TML.XTL.TXXT.0DAY.HACK.ERS-(1995)-BLURAY-CAM_XVID.EXE.TAR.[SCR].LISTP.MSI.LNK.ZDA.GNN.WRBT.OBJ.O.SWF.DPKG.APP.ZIP.TAR.CO.GZ.OUT.EXE</nowiki>

:[Two buttons:]
:Cancel Save

{{comic discussion}}
[[Category:Comics with color]]
[[Category:Computers]]