XP SP2 Using Alternate Data Streams for Security Warnings

A while ago I blogged about Alternate Data Streams and how they are hidden from the users.

At that time, you could assume that when an ADS was present, it was something special, because not many normal files have an ADS attached.

But yesterday I got an interesting question about XP SP2 showing a security warning when you want to execute something downloaded from the Internet.

We guessed Alternate Data Streams were used, so I checked this out and it turns out XP SP2 indeed adds an ADS when you download a file from the Internet.

This stream is called Zone.Identifier and contains the following information:

D:\Tmp>more < TestZip.zip:Zone.Identifier
[ZoneTransfer]
ZoneId=3

Since SP2 did this, it probably means it’s a modification to Internet Explorer.

So, I got Firefox 1.0.3 and downloaded a file with the default settings, and as I guessed, no ADS with Zone.Identifier.

I believe Firefox doesn’t have such a thing as zones, but it would be nice if Firefox added this ADS so the new security warning, informing you it’s a downloaded file, comes up.

Update: Firefox, like every major browser, now adds the Zone.Identifier stream (known as the Mark of the Web) to downloads.