1247: The Mother of All Suspicious Files - Revision history

Aaron of Mpls: recent → then-recent

2026-04-04T16:55:21Z

recent → then-recent

Lettherebedarklight: /* Transcript */ add Category:Comics with a Spanish translation

2025-12-15T08:56:50Z

‎Transcript: add Category:Comics with a Spanish translation

CalibansCreations: /* Explanation */

2025-01-08T10:06:04Z

‎Explanation

172.68.205.179: /* Explanation */

2024-10-04T23:42:18Z

‎Explanation

Sillybones at 22:49, 4 October 2024

2024-10-04T22:49:24Z

JLZ0kTC5: current link

2023-10-17T12:06:11Z

current link

FaviFake: Fixed old http:// link

2023-06-27T07:38:10Z

Fixed old http:// link

162.158.166.125: /* Explanation */

2022-12-08T10:32:16Z

‎Explanation

TinyDeskEngineer: /* Explanation */ Fixed link to Wikipedia page for dynamic-link library

2022-11-02T21:19:33Z

‎Explanation: Fixed link to Wikipedia page for dynamic-link library

162.158.78.141: Undo revision 272278 by Explain xkcd server admin (talk)

2022-05-21T02:16:07Z

Undo revision 272278 by Explain xkcd server admin (talk)

Show changes

@@ Line 10: / Line 10: @@
 Modern operating systems try to intercept malicious files before they can be downloaded. This comic depicts a {{w|dialog box}} requiring the user to confirm if they want to download a potentially dangerous file &mdash; and it turns out the file being downloaded is absolutely filled with a truly absurd number of file extensions. Many of the {{w|file extension|extensions}} used inside there indicate executable code; multiple file extensions are sometimes used to disguise a {{w|Trojan horse (computing)|trojan program}} as a document. The sheer number of extensions in the comic wouldn't just look out of place on a safe file, it's also far more than an actual computer virus would bother to have, thus the humor.
-The first part of the suspicious file's name is <tt><nowiki>http://65.222.202.53</nowiki></tt>, an {{w|IP address}} that hosted {{w|JavaScript}} {{w|malware}} during a recent attack on the {{w|Tor anonymity network}}, with a very long file title.
+The first part of the suspicious file's name is <tt><nowiki>http://65.222.202.53</nowiki></tt>, an {{w|IP address}} that hosted {{w|JavaScript}} {{w|malware}} during a then-recent attack on the {{w|Tor anonymity network}}, with a very long file title.
 You can also see common download syntax for a pirated movie, {{w|Hackers (film)|''Hackers''}}, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. It is described as "<tt>_BLURAY_CAM</tt>", which contradicts itself ("<tt>_BLURAY</tt>" would imply it was ripped from a copy on {{w|Blu-ray Disc}}, while "<tt>_CAM</tt>" would mean it was copied by pointing a camera at the screen in the cinema). "<tt>_BLURAY_CAM</tt>" would probably indicate a search-keyword-stuffed fake copy; fake pirated media often contain viruses (although this is more likely to be a problem with newer media, before the first real pirated copy appears).

← Older revision		Revision as of 08:56, 15 December 2025
Line 70:		Line 70:
	[[Category:Computers]]		[[Category:Computers]]
	[[Category:Video games]]		[[Category:Video games]]
		+	[[Category:Comics with a Spanish translation]]

@@ Line 35: / Line 35: @@
 *<tt>.txxt</tt> — a play on <tt>{{w|Text file|.txt}}</tt> file types.
 *<tt>0DAY.HACK</tt> — a reference to a {{w|zero-day exploit}}. (overlaps with the next entry)
-*<tt>HACK.ERS_(1995)_BLURAY_CAM-XVID</tt> — a reference to the 1995 {{W|Hackers (film)|''Hackers''}} movie, but pirated movies would either be a <tt>BLURAYRIP/DVDRIP</tt> or <tt>CAM</tt>, but not both at the same time unless you used a camera to record a {{w|Blu-Ray}} movie as it played. {{w|Xvid}} is a particular video codec, originally commercial, which may require specific support to produce or to play. It is not unusual, in certain circles, to include the codec in use in media file-names in order that favored (or unfavorable) ones can be chosen specifically to download (or not). <!-- Alternatively, it could be a self-styled tag by which the originating 'rippers' make themselves known or some other reference to '{{w|X rating|X-Rated}} Video', but ...why complicate matters? I bet it's the patent-mired codec thing. -->
+*<tt>HACK.ERS_(1995)_BLURAY_CAM-XVID</tt> — a reference to the 1995 {{W|Hackers (film)|''Hackers''}} movie (previously referenced in [[689: FIRST Design]], and later in [[1337: Hack]]), but pirated movies would either be a <tt>BLURAYRIP/DVDRIP</tt> or <tt>CAM</tt>, but not both at the same time unless you used a camera to record a {{w|Blu-Ray}} movie as it played. {{w|Xvid}} is a particular video codec, originally commercial, which may require specific support to produce or to play. It is not unusual, in certain circles, to include the codec in use in media file-names in order that favored (or unfavorable) ones can be chosen specifically to download (or not). <!-- Alternatively, it could be a self-styled tag by which the originating 'rippers' make themselves known or some other reference to '{{w|X rating|X-Rated}} Video', but ...why complicate matters? I bet it's the patent-mired codec thing. -->
 *<tt>{{w|EXE|.exe}}</tt> — an executable file type used by Microsoft Windows.
 *<tt>[SCR]</tt> — a tag used by movie pirates to denote a '{{w|Screener}}', the DVD copy of films given to critics prior to theater release. Usually the highest quality available at the time, rare, and thus good bait for a virus-laden download. "{{w|.scr}}" is also the extension for screensaver files, really just an exe file with a different extension and one of the classical ways to distribute infected files.

@@ Line 35: / Line 35: @@
 *<tt>.txxt</tt> — a play on <tt>{{w|Text file|.txt}}</tt> file types.
 *<tt>0DAY.HACK</tt> — a reference to a {{w|zero-day exploit}}. (overlaps with the next entry)
-*<tt>HACK.ERS_(1995)_BLURAY_CAM-XVID</tt> — a reference to the 1995 {{W|Hackers (film)|''Hackers''}} movie, but pirated movies would either be a <tt>BLURAYRIP/DVDRIP</tt> or <tt>CAM</tt>, but not both at the same time unless you used a camera to record a {{w|Blu-Ray}} movie as it played. The "XVID" part could be a reference to adult media, a common delivery vector for malware.
+*<tt>HACK.ERS_(1995)_BLURAY_CAM-XVID</tt> — a reference to the 1995 {{W|Hackers (film)|''Hackers''}} movie, but pirated movies would either be a <tt>BLURAYRIP/DVDRIP</tt> or <tt>CAM</tt>, but not both at the same time unless you used a camera to record a {{w|Blu-Ray}} movie as it played. {{w|Xvid}} is a particular video codec, originally commercial, which may require specific support to produce or to play. It is not unusual, in certain circles, to include the codec in use in media file-names in order that favored (or unfavorable) ones can be chosen specifically to download (or not). <!-- Alternatively, it could be a self-styled tag by which the originating 'rippers' make themselves known or some other reference to '{{w|X rating|X-Rated}} Video', but ...why complicate matters? I bet it's the patent-mired codec thing. -->
 *<tt>{{w|EXE|.exe}}</tt> — an executable file type used by Microsoft Windows.
 *<tt>[SCR]</tt> — a tag used by movie pirates to denote a '{{w|Screener}}', the DVD copy of films given to critics prior to theater release. Usually the highest quality available at the time, rare, and thus good bait for a virus-laden download. "{{w|.scr}}" is also the extension for screensaver files, really just an exe file with a different extension and one of the classical ways to distribute infected files.

@@ Line 35: / Line 35: @@
 *<tt>.txxt</tt> — a play on <tt>{{w|Text file|.txt}}</tt> file types.
 *<tt>0DAY.HACK</tt> — a reference to a {{w|zero-day exploit}}. (overlaps with the next entry)
-*<tt>HACK.ERS_(1995)_BLURAY_CAM-XVID</tt> — a reference to the 1995 {{W|Hackers (film)|''Hackers''}} movie, but pirated movies would either be a <tt>BLURAYRIP/DVDRIP</tt> or <tt>CAM</tt>, but not both at the same time unless you used a camera to record a {{w|Blu-Ray}} movie as it played.
+*<tt>HACK.ERS_(1995)_BLURAY_CAM-XVID</tt> — a reference to the 1995 {{W|Hackers (film)|''Hackers''}} movie, but pirated movies would either be a <tt>BLURAYRIP/DVDRIP</tt> or <tt>CAM</tt>, but not both at the same time unless you used a camera to record a {{w|Blu-Ray}} movie as it played. The "XVID" part could be a reference to adult media, a common delivery vector for malware.
 *<tt>{{w|EXE|.exe}}</tt> — an executable file type used by Microsoft Windows.
 *<tt>[SCR]</tt> — a tag used by movie pirates to denote a '{{w|Screener}}', the DVD copy of films given to critics prior to theater release. Usually the highest quality available at the time, rare, and thus good bait for a virus-laden download. "{{w|.scr}}" is also the extension for screensaver files, really just an exe file with a different extension and one of the classical ways to distribute infected files.

@@ Line 42: / Line 42: @@
 *<tt>{{w|.lnk}}</tt> — an extension used by Microsoft Windows for shortcuts. The extension is normally hidden to the user.
 *<tt>.lnk.zda.gnn</tt> — references to {{w|Link (The Legend of Zelda)|Link}}, {{w|Princess Zelda|Zelda}}, and {{w|Ganon}}, important characters from ''{{w|The Legend of Zelda}}'' video game franchise.
-*<tt>{{w|White Rabbit#Television and films|wrbt.obj}}</tt> — A reference to the line of code Dennis Nedry used in ''{{w|Jurassic Park}}'' to shut down key systems.
+*<tt>{{w|White Rabbit#Films|wrbt.obj}}</tt> — A reference to the line of code Dennis Nedry used in ''{{w|Jurassic Park}}'' to shut down key systems.
 *<tt>{{w|Object file|.o}}</tt> — The extension for a {{w|Linker (computing)|linker file}}, an intermediary created when compiling {{w|C programming language|C code}}.
 *<tt>{{w|Header file|.h}}</tt> — The file extension of a {{w|header file}} in C code.

@@ Line 55: / Line 55: @@
 The title text suggests changing from <tt>http</tt> to <tt>https</tt>, as if encrypting a suspicious file before downloading it is somehow better than downloading it unencrypted. <tt>{{w|http}}</tt> (Hypertext Transfer Protocol) and <tt>{{w|https}}</tt> (Hypertext Transfer Protocol – Secure) are the two common protocols for getting web pages and web downloads. http is the simple download, whereas https adds an SSL encryption layer so the item being downloaded cannot be viewed unencrypted by anyone except the end recipient. Changing <tt>http</tt> to <tt>https</tt> is a common suggestion to improve security when browsing the web from an insecure network (such as a public {{w|WiFi}} hotspot) to avoid surveillance or hijacking to a malicious website; Google automatically switches to <tt>https</tt> for all mail accounts and is starting to do so with searches. The end recipient will still get whatever nasties were in the original, however — encrypting it doesn't change the content at all.
-The {{w|IP address}} referenced in the comic, <tt>65.222.202.53</tt>, was, at the time this article was authored, being used by the shellcode of a {{w|JavaScript}} {{w|zero-day exploit}} for the {{w|Tor Browser Bundle}} being run by the {{w|FBI}} to phone home over the clearnet [http://thehackernews.com/2013/08/Firefox-Exploit-Tor-Network-child-pornography-Freedom-Hosting.html] and deanonymize visitors to websites on Freedom Hosting that are serving child pornography. [http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/]
+The {{w|IP address}} referenced in the comic, <tt>65.222.202.53</tt>, was, at the time this article was authored, being used by the shellcode of a {{w|JavaScript}} {{w|zero-day exploit}} for the {{w|Tor Browser Bundle}} being run by the {{w|FBI}} to phone home over the clearnet [https://thehackernews.com/2013/08/Firefox-Exploit-Tor-Network-child-pornography-Freedom-Hosting.html] and deanonymize visitors to websites on Freedom Hosting that are serving child pornography. [https://www.reddit.com/r/onions/comments/1jmrta]
 As the last extension in the file is .exe, a Windows computer would run the file like an application. Usually, it is not safe to run unknown .exe files.

@@ Line 8: / Line 8: @@
 ==Explanation==
-The save {{w|dialog box}} shows a download from the address <tt><nowiki>http://65.222.202.53</nowiki></tt>, an {{w|IP address}} that hosted {{w|JavaScript}} {{w|malware}} during a recent attack on the {{w|Tor anonymity network}}, with a very long file title. Many of the {{w|file extension|extensions}} used inside there indicate executable code; multiple file extensions are sometimes used to disguise a {{w|Trojan horse (computing)|trojan program}} as a document.
+Modern operating systems try to intercept malicious files before they can be downloaded. This comic depicts a {{w|dialog box}} requiring the user to confirm if they want to download a potentially dangerous file &mdash; and it turns out the file being downloaded is absolutely filled with a truly absurd number of file extensions. Many of the {{w|file extension|extensions}} used inside there indicate executable code; multiple file extensions are sometimes used to disguise a {{w|Trojan horse (computing)|trojan program}} as a document. The sheer number of extensions in the comic wouldn't just look out of place on a safe file, it's also far more than an actual computer virus would bother to have, thus the humor.
 You can also see common download syntax for a pirated movie, {{w|Hackers (film)|''Hackers''}}, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. It is described as "<tt>_BLURAY_CAM</tt>", which contradicts itself ("<tt>_BLURAY</tt>" would imply it was ripped from a copy on {{w|Blu-ray Disc}}, while "<tt>_CAM</tt>" would mean it was copied by pointing a camera at the screen in the cinema). "<tt>_BLURAY_CAM</tt>" would probably indicate a search-keyword-stuffed fake copy; fake pirated media often contain viruses (although this is more likely to be a problem with newer media, before the first real pirated copy appears).

@@ Line 12: / Line 12: @@
 You can also see common download syntax for a pirated movie, {{w|Hackers (film)|''Hackers''}}, likely included to appear malicious to anyone skimming but is actually a movie about hackers, making it a benign reference rather than malicious. It is described as "<tt>_BLURAY_CAM</tt>", which contradicts itself ("<tt>_BLURAY</tt>" would imply it was ripped from a copy on {{w|Blu-ray Disc}}, while "<tt>_CAM</tt>" would mean it was copied by pointing a camera at the screen in the cinema). "<tt>_BLURAY_CAM</tt>" would probably indicate a search-keyword-stuffed fake copy; fake pirated media often contain viruses (although this is more likely to be a problem with newer media, before the first real pirated copy appears).
-The {{w|URL}} contains the path "<tt>~tilde/pub/cia-bin/etc</tt>". The first part is a public folder of a user named "tilde" (which is also the name for the {{w|tilde|~ symbol}}), "<tt>cgi-bin</tt>" is a common folder on a web server for server-side executables ([[Randall]] changes the name to "<tt>[[CIA|cia]]-bin</tt>"), and "<tt>etc</tt>" is a standard folder for configuration files – normally never accessible through a web server. The program "init.dll" isn't executable at all, it's a {{w|Windows Dynamic Link Library}} which can't be run standalone, and is rarely referenced in URLs (even though such syntax is still being employed, even on [https://www.google.com/search?q=site:edu+filetype:dll reputable websites (Google search)] or here at [https://signin.ebay.com/ws/eBayISAPI.dll eBay], indicating the webserver is a Microsoft {{w|Active Server Pages|ASP}} server). The question mark indicates the start of a parameter list, and in this case we have only one named "<tt>FILE</tt>".
+The {{w|URL}} contains the path "<tt>~tilde/pub/cia-bin/etc</tt>". The first part is a public folder of a user named "tilde" (which is also the name for the {{w|tilde|~ symbol}}), "<tt>cgi-bin</tt>" is a common folder on a web server for server-side executables ([[Randall]] changes the name to "<tt>[[CIA|cia]]-bin</tt>"), and "<tt>etc</tt>" is a standard folder for configuration files – normally never accessible through a web server. The program "init.dll" isn't executable at all, it's a {{w|Dynamic-link library}} which can't be run standalone, and is rarely referenced in URLs (even though such syntax is still being employed, even on [https://www.google.com/search?q=site:edu+filetype:dll reputable websites (Google search)] or here at [https://signin.ebay.com/ws/eBayISAPI.dll eBay], indicating the webserver is a Microsoft {{w|Active Server Pages|ASP}} server). The question mark indicates the start of a parameter list, and in this case we have only one named "<tt>FILE</tt>".
 The "Save" button is greyed out, suggesting that it is disabled; you can click only the "Cancel" button. For security reasons, some browsers (like Firefox) disable the "Save" button for a few seconds before enabling it. This prevents users from accidentally accepting a download while entering input, like a malicious CAPTCHA.