> It is not downloading malware that is the issue, it's executing it.
That line is very thin. Local DLLs, application configs setting path to executables, even desktop.ini (https://threat.tevora.com/usb-drives-desktop-ini-and-ntlm-ha...) and that's before we get into NTFS alternative streams and other really out there ideas.
If you can choose which path you download to, the user has lost. Even if they never actively execute the file.
Same on *nix. If you can add something to bashrc, or drop a new file in desktop autostart, who cares about the executable bit.
And sometimes you can point out bad ideas without reading the spec. WebUSB was that kind of bad idea even before someone figured out exactly how they can read one time codes from security dongles that way. (https://www.yubico.com/support/security-advisories/ysa-2018-...)
That line is very thin. Local DLLs, application configs setting path to executables, even desktop.ini (https://threat.tevora.com/usb-drives-desktop-ini-and-ntlm-ha...) and that's before we get into NTFS alternative streams and other really out there ideas.
If you can choose which path you download to, the user has lost. Even if they never actively execute the file.
Same on *nix. If you can add something to bashrc, or drop a new file in desktop autostart, who cares about the executable bit.
And sometimes you can point out bad ideas without reading the spec. WebUSB was that kind of bad idea even before someone figured out exactly how they can read one time codes from security dongles that way. (https://www.yubico.com/support/security-advisories/ysa-2018-...)