The "NTFS corruption" bug
ฝัง
- เผยแพร่เมื่อ 25 ก.ค. 2024
- CORRECTION: WEBSITES CANNOT TRIGGER THE BUG
Have you heard the news of this super-scary creepy NTFS vulnerability? Well, it's neither of those...watch this video to find out the real details!
Sources in the video:
- www.bleepingcomputer.com/news...
- search?q=NTFS (bet you could have guessed this one)
- / ntfs-part-5
- www.joshodgers.com/tag/torn-wr...
- www.theverge.com/2021/1/15/22...
0:00 Intro
0:35 #1: The media hype
1:05 #2: Dirty disks
3:01 #3: Why does it happen?
3:57 #4: Big deal?
5:51 #5: Triggering the bug
7:45 #6: Other Windows Versions
8:32 #7: Future outlook
-----
Join the channel's discord server "The Flying Tech"!
bit.ly/FlytechDiscord
Follow me on Twitter:
/ flytechvideos
Join this channel to get access to perks:
/ @flytechvideos
-----
EVA - Futurismo: • EVA - Futurismo [Synth...
Hot Chocolate by Stevia Sphere
steviasphere.bandcamp.com
Promoted by Royalty Free Planet: royaltyfreeplanet.com
Creative Commons Attribution 3.0
creativecommons.org/licenses/...
#lookinside #ntfs #flytech - วิทยาศาสตร์และเทคโนโลยี
![Inside Windows Shortcuts (LNK Files) [Part 1]](/img/n.gif)
Scammers cannot use that HTML image technique because of the same-origin policy integrated into all browsers, which means they will not be able to access that location, as long as the HTML is on a remote server, and thus not set the dirty bit.
you can easily troll unsuspecting friends or family members with it tho ;)
-No, this is not SOP related. Some sites might forbid it via the CSP, but the CSP is server-owner controlled. Nothing is preventing you from including resources from other sites (e.g. Google Image Search can also include images from other sites)-
yep you're right
@@FlyTechVideos not from local storage, though, which is the whole point of that "vulnerability"
If I'm right, JavaScript *runs* in the browser (not on the server!) meaning if you have a way to access that in some way you might be able to still trigger it from a remote server. Haven't tried this yet though. *Might be completely wrong, I'm not sure.*
Anyone else confused.
Just saw Enderman's version a little bit ago. This should be good.
Gonna add this to my game so if you loose the boss fight it looks like the main bad guy is doing stuff
I can't understand how Windows fixed it in 7, then broke it again in 10. It's so funny yet stupid.
You can't understand that? Windows 10 is a pile of garbage; it makes sense that its FULL of bugs. 😒 (Windows 11: Hold my B.E.E.R. PARTIES…)
Because Microsoft
@xeliicious WHY U SAY THE S WORD
@@alli-windowsexpert why you replying to a 3 year old comment lmao
First was Enderman version, followed by Siam Alan version and, finally, we have Flytech version. The digital triforce now is complete.
Yes, but FlyTech
explained in more detail =)
These three are the ultimate trios
@EternalGames h
Digital trio Triple the tech
@EternalGames it was globalroot, but A for effort
Disk is dirty? Put it in the diskwasher!
lol
Finally, it was nice for once to have windows 7.
Same.
and 8.1
Raspbian Buster.
Manjaro Linux
@@SFSAtlas Linux Mint.
He knows this
He knows that
He knows it all about the OS
Who you gonna call?
FlyTech Videos
@Carlos Maukonen no shit
@Carlos Maukonen no one cares
@Carlos Maukonen r/wooosh
@Carlos Maukonen your pfp is stolen"!!!!`1
Your system has crashed
:
Windows once "repaired" my hard drive. It turned everything into raw and completely destroyed NTFS
Press F to pay respect
F
now how the hell is that possible
Add terminal logo:>_ to not pay respects
Thank you so much for adressing this! Love all your videos:)
0:19 I like that error code
Oh, thank you for making this video. I thought my hard drive is corrupted.
Yeah the $BITMAP stream is essentially actual file extent locations, and having two of these is a corruption, especially when one of them is in a wrong format. You can still make these corrupted streams in Linux, but it's not that useful.
0:37 damn jan 24th? how do i time travel like you!1!1!1!1!
14th :E
24th OF Jan.
@@simontay4851 no, 14th
@@simontay4851 are you two blind?
@@SquooshyShark1000 OH, look, Gelatin.
Very good video. Thank you.
like 3 discord servers i'm on started screaming at me about this vulnerability
this shouldn't even be a thing how was this not discovered
what, im subscribed to you and i didnt expect to see you here.
@@goodrun88 lmao
hamburger
so i think i have a problem cause of this. I cannot format my SSD, cannot clean via CMD Diskpart, cannot Delete volume, and what i mean is my Disk is become invulnerable. Everytime i went for a chkdsk it only got me a normal boot restart even it said there will be a checking. Any help? i don't know what can i do next.. i cannot do anything with my SSD. please if you all got something, tell me i would try to do anything to remove this even gotta delete all of my SSD data cause ive tried many ways but I can't
You can also create a death .bat file that runs the command
someone got me to run the line in my browser and after restarting my pc basically everything went back to normal, but it tries to do a chkdsk every time i boot. is there a way to disable this?
hi @FlyTech i have an question, why the folder:Documents and Settings in windows 10 is already a folder: Users?
I'm pretty sure it doesn't exist, it's a windows XP thing.
lol i like how you made the html file seem like it predicted that your drive got corrupted.
Holy. I switched to Linux week ago and now I want to try this bug AAAAA
Lol
you can use a virtual machine with windows
@@Someguyy well- yeah I just don't know why the iso download always fail.. I only have windoze 98 rn
"debugfs -wR dirty /dev/whatever" is close enough :)
I've tried to run this with Windows 8.1 and it trashed the partition...
Startup Repair and chkdsk didn't work for fixing it.
i tried in windows 7 it just say : "there are no specified location". Just like that
Restarted and got stuck in recovery loophole did the windows again and same notification appeared. Any suggestion what's wrong?
Oh, so they probably optimized away something to keep access to MFT fast. Since on some machines only one logical volume is present literally all access goes through MFT so they sacrificed correctness for speed
Hi mate, i don't know if my problem is related to this however when i ran the chkdsk util after a bsod error: ''UNEXPECTED STORE EXCEPTION'' and another ''CRITICAL PROCESS DIED".
The chkdsk returned several lines of errors:
Error detected in index $I30 for file AEA5
Error detected in index $I30 for file AEA5
Error detected in index $I30 for file AEC1
Error detected in index $I30 for file AEC1
Error detected in index $I30 for file AEC7
Error detected in index $I30 for file AEC7
I'm confused as I've not seen this exact problem on youtube, please can you help.
Once I saw a notification saying FIX DRIVE ERRORS CLICK TO RESTART YOUR PC. I clicked it and it restarted my PC, started a ChkDsk scan, started a Startup Recovery scan, then got to work on the drive errors. It took about 15 minutes before restarting into Windows.
1:53 This happened in mine too as it checked the C drive then after that it suddenly go into Startup Repair mode for no reason…
18 minutes ago and now the video thumbnail attracts me :)
Edit: after watching this video there will be so many exploits and viruses to windows user even through internet
Not really, most updated browsers block sources from localhost, meaning that the only way to trigger the bug with a web is if the web is in the local machine, otherwise any website could use this bug because the browser will just block it
Hey flytech videos, when i do "NTFS Corruption" bug, and then when i do chkdsk, it will my data get corrupt? Im very scary when i do chkdsk, and then, my data get corrupted or get deleted (sorry for bad english)
well, it should not, but i wouldn't risk it. don't do it!
@@FlyTechVideos
i don't know why, and i didn't do anything, but, i got messages from my friends like this "do cd C: / $ i30: $ bitmap on your cmd" but i didn't do that, when i searched on google like this "what is cd C: / $ i30: $ bitmap" and then I restart it, and then I get a notification message "restart to fix drive error", I want to press it, but I'm afraid that any of my folders or files exist that is corrupted or lost. (Sorry for bad grammar again)
@@GuckTubeYT don't worry, just do the chkdsk, nothing bad will happen
@@FlyTechVideos oh okay, thanks
@ThatPcGeek i want to try, but, i dont have enough storage
My windows xp pc can't boot anymore because chkdsk idk what is the problem
Good Job! but what if we try The "NTFS corruption" bug in Old Windows versions? (not in XP)
Wouldn't there be a way to forcefully reset the dirty bit without running a chkdsk scan?
not through intended means, no
@@FlyTechVideos im your biggest fan
Aha, this is why my AV random alerts me to Win32:NTFSCorruption-B... ever if my Windows clean...
me, a linux user: haha lol windows got another bug
Something do be wrong with Windows tho
i swear i always read NTFS as NFTS
Urnotheayonliwun
NFTs
I actually have a dirty drive. When i restart to fix drive errors, it just asks again, so the restard was a waste of time. How does i fix it?
Can you try this out and see what happens on a windows XP and Windows 2000 (w2k has ntfs support)
he tried xp
@@taududeblobber221 oh ok but i would like to see if someone could try 2000 since it has ntfs support
@@YeetiusMaximusYT I tried it with Windows Vista and 2000, Both are not affected.
I agree with MS this is not critical but NOT because it requires social engineering. NEVER underestimate social engineering, it's the way most of the modern hacks to big companies happen (eg the recent Twitter hack)
Social engineering is extremely powerful and relatively easy for an experienced player to pull off, especially when it requires getting into intricate stuff like command line and NTFS alternate streams, where chances are whoever is on the other side of the screen will not know better to understand what's going on. Remember that scammers stole people money for years using nothing more than tree and color.
It is kinda like the Con/Con bug in windows 9x
actually not this one, but the Win10 BSOD bug does.
The new C:/con/con
How this bug doesn't work on Windows 7 and 8, but work in newer and older systems (i was meant Windows 10 before the bug fix of this issue and Windows XP)
I clicked on it, forgot I had it on and I thought my headphones were broken at the intro
Ah chkdsk. I remember turning on the shittop (shit laptop) and turning on the tv (it had a broken hinge so I didn’t want to use the open close feature, the thing eventually broke down and ran chkdsk, it then proceeded to un update itself.
So is it just running a command that makes your system do something that it can "predict?"
Bro, when I was trying to install windows 7 it showed the boot screen fixing the disk errors
I just google searched it and it triggered the bug. Not on a VM either... ouch
Make a video trying to access the net group command on windows 10
4:29 not the *uer* !
Well Fly tech, scammers can't activate the bug since new browsers have sandbox features which will isolate the website from host by making an fake dir or disk(until you gave the permission to website for accessing local storage but then too website can only read files not write to the disk) also when we drop a file in website (eg. Photo converter) it first get copied to a folder then it get to the web I think
I have added a short info to the description
@@FlyTechVideos ok
@@FlyTechVideos I just explained the discription in detail
Avast antivirus actually denied clicking on this page, "because it was infected with Win32:NtfsCorrupt-B[Expl]"
Why did just the name triggered it ? And why second clip allowed the page to load.
Actually, no. Avast doesn't let me watch the video part of the page, everything else work
Now working after FlyTech tweaked some things near the end of the premiere
Avast already recognizes it, and prevents it. Good move.
@@malwaretestingfan Yes, at least they're not inactive, that's cool !
I got multiple Win32:NtfsCorrupt-B[Expl] the same day, at first x site couldn't be accessed and after when I restarted it. The website works although avast still block the same thing, but I know my pc is not infected. What a weird bug but I am glad Avast could detect it
@@shirouemiya751 it's too sensitive, even if it appears as text it will trigger the av without doing anything at all to the computer
yay
And this is why I still use windows 7 to this day.
OMFG ONLY THE OGS REMEMBER THIS SONG
I can't breathe...
0:12 how can you make websites like this?
my school pcs dont block powershell, i know what i have to do now
jokes on you, i use linux, i can’t be harmed by foolish programmers when i use zfs
*ext4
@@SFSAtlas you know that there are more file systems than ext4?
@@404oops zfs sucks.
@@XsaviXander and Why exactly?
It fixed lol
This happend to me but it was total error without me searching something, and it fixed itself huh
I see what you did here.
,,Hello, your computer has virus”
Looks like I'll be booting to Windows 7 hard drive whenever I power on my PC, that's the advantage of having Retail licenses on OS's.
next do safe mode stuff if you can. that safe mod diffrens from normal mode. or somthing like that.
how about windows 8.1?
did this on my physical machine and it does the same thing
nothing is corrupted either
Pog
4:33 uer (user) flytech
why do i feel like i will break my pc watching this lol
I clicked on the popup, then got to restart and my drive suddently got RAW, how did that happen?!
In old computer, I was use Windows XP in first time. IDK why chkdsk check my disk C: always. Now watch your video, I know why chkdsk check my disk C: always because some has use The "NTFS corruption" bug. Now I use Windows 7 in old computer. 1 sub for you!
For me this is terrifying cuz chkdsk actually corrupts my hard drive
How
Btw this worked on my friends windows 7 laptop. He hasn’t been able to turn it on since. Probably had something else wrong with it.
that's not "working" because this bug doesn't cause any real damage, must be another issue
So basically if windows pops up with this error after visiting a website, it can just be ignored?
No. (Sorry for delay) at reboot tho you can skip chkdsk, but at every boot you will have to skip it (or you will have to run a full chkdsk to make it stop)
*drive marked dirty* ok **washes drive with soap and water**
I don't think scammers could use the Shortcut Icon method. If you download the shortcut, it is no longer a shortcut.
Saw at enderman, siam alam and now you :D
The bug isn't able to be triggered through a , but how about a page that redirects you to the malicious link? will it work?
No, you cannot in any way launch local content from a remote website. i tried
@@FlyTechVideos :( big sad
Whew, I read the title wrong, thought it was "The NFTS corruption bug"
ok
But what about Vista?
DISK PARTITION YEEEEEEEEEEEE FILES GOIN CRAZY REEEEE
Bro watching this just refreshed page💀💀
this bug only works in windows 10?
What if i dont?
Oh great, I'm running a boot chkdsk because I clicked on this. (Edit: by mistake) It's actually just one of my partitions has a dirty bit. Backed up everything before running it so thats good
@FlyTech Videos
January 24th??????????????? ITS ONLY 16 DAYS INTO 2021!
The patch was fixed- I entered my host PC with this command line: cd C:\:$i30\:$bitmap
Result:
The filename, directory name, or volume label syntax is incorrect.
Result on fsutil:
Volume - C: is NOT dirty
Windown Version: 19042.746 (20H2)
My eyes, why did I put a backslash on the :$i30 :bitmap
good, i got a bunch of av alerts that i got infected with win32 Ntfs corrupt, glad its not bad..
same, avast seems to thinks this is extremely dangerous bug, i had to add a few exceptions because it interfered with my normal usage of youtube and chrome's history, it even triggered with a notification of a comment response
i did it once to my old laptop and it scared the sh*t out of me
i'm gonna use this to make an app titled "corrupter"
And I thought it was just the website sending a fake notification...
This bug presents on windows xp
0:39 He time traveled.
no
it doesnt work on build 21292 of windows 10
4:31 uer????
cd c/:i30:$bitmap does not work for me running the latest windows 10 insider build, maybe Microsoft patched it
C:\, not c/
You can install Windows 10 on your android phone first go to google play store then search wins 10 simulator and click install then open the app
4:28 u e r
Can it be accessed by loading a CSS file?
CSS can only reference files from another HTTP server or relative URLs from your own server assuming you are using url(). If you are working locally, you can use the file:// protocol but this is immediately stopped in it's tracks by CSP when applied outside of your local enviornment.
@@Tropical126 Yes? Then can it be used with location = 'file://C:/:$i30:$bitmap'?
@@unknownaccount4783 Only in a local environment. If you aren't accessing the file directly through your hard disk it will get blocked.
HOW DID YOU GOT THAT SECRET ANIMATION?!?!?!?!
Which?
it's an insider build
@ThatPcGeek thnx
4:28 typo?
I found a directory that can’t be accessed
Him saying to call phone to get pc back
Me: man if you want my pc go ahead ill not call