| Q: What are directory junctions and how can they be so dangerous? |
|
A: A directory junction, is a junction point that redirects a reference from one directory to another directory on the same machine.
In the Unix world it is known as a symbolic link or symlink. Juntion points were introduced in Windows 2000 and later operating systems with NTFS 3.0.
What makes a directory junction so dangerous? An attacker can set a directory junction to trap an unsuspecting user into potentially deleting his entire operating system, or other equally important directory or folder. How? If a user (or program ran by the user) issues a destructive recursive command, such as rd /s (to remove directory recursively including sub folders) and that directory contains a directory junction to another directory, for example your c:/windows/system32 directory, you will unknowingly destroy your entire system folder! If you use a file shredder, internet history eraser, or any other type of program that makes destructive recursive calls then you should make sure you know if that program can detect and avoid directory junctions. AceErase automatically detects and avoids traversing through directory junctions. Shred safely with AceErase! |