{"id":96357,"date":"2019-08-13T07:01:34","date_gmt":"2019-08-13T14:01:34","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=96357"},"modified":"2025-06-06T01:48:53","modified_gmt":"2025-06-06T08:48:53","slug":"the-twin-journey-part-3-im-not-a-twin-cant-you-see-my-whitespace-at-the-end","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/the-twin-journey-part-3-im-not-a-twin-cant-you-see-my-whitespace-at-the-end\/","title":{"rendered":"The Twin Journey, Part 3: I’m Not a Twin, Can’t You See my Whitespace at the End?"},"content":{"rendered":"

In this series of 3 blogs (you can find part 1 here<\/a>, and part 2 here<\/a>), so far we have understood the implications of promoting files to \u201cEvil Twins\u201d where they can be created and remain in the system as different entities once case sensitiveness is enabled, and some issues that could be raised by just basic assumptions on case-sensitiveness during development.<\/p>\n

In this 3rd post we focus on the \u201cconfusion\u201d technique, where even though the technique is already known (Medium<\/a> \/ Tyranidslair<\/a>), the ramifications of these effects have not all been analyzed yet.<\/p>\n

Going back to normalization, some Win32 API\u2019s remove trailing whitespaces (and other special characters) from the path name.<\/p>\n

As mentioned in the last publication, the normalization can, in some cases, provide the wrong result.<\/p>\n

The common scenario that could be used as \u201cbait\u201d for the user to click, and even to hide what is seen, is to create a directory with the same name ending with a whitespace.<\/p>\n

A very trivial example \u201cThat\u2019s not my notepad\u2026..\u201d:<\/p>\n

\"\"<\/p>\n

Open task manager, Right click on the \u201cnotepad\u201d with putty icon -> Properties. (The properties were read from the \u201cnon-trailing-space\u201d binary)<\/p>\n

Open Explorer on \u201cC:\\Windows \u201c; it will generate the illusion that the original files (from the folder without trailing whitespace) are there. This will happen for any folder\/file not present in the whitespace version.<\/p>\n

Screenshots opening a McAfee Agent Folder:<\/p>\n

Both folders opened; note that the whitespace version does not have any .dll or additional .exe but Explorer renders the missing files from the \u201cnormalized \u2013 non-whitespace directory\u201d.<\/p>\n

\"\"<\/p>\n

Trying to open the dll\u2026<\/p>\n

\"\"<\/p>\n

Getting properties from task manager will fetch those from the normalized folder path, that means you can be tricked to think it is a trusted app.<\/p>\n

\"\"<\/p>\n

Watch the video recorded by our expert Cedric Cochin illustrating this technique:<\/p>\n