Shortcut zero-day attack code goes public

Filed Under: Video, Vulnerability, Windows

Danger zone
If you've been following Chet Wisniewski's articles over the last few days you will already know about the serious zero-day vulnerability that has been found in versions of Windows.

Since confirmed by Microsoft, there exists a vulnerability in versions of Windows which allows a maliciously-crafted Windows shortcut file (.lnk) run a malicious DLL file, simply by being viewed on a USB stick.

Furthermore, the attack can be initiated automatically by viewing an affected USB storage device via Windows Explorer, even with AutoRun and AutoPlay are disabled. The Microsoft Security Response Center (MSRC) says that the security hole can also be remotely exploited via WebDAV and network shares.

You can watch the following YouTube video where Chet shows the attack in action:

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

In this case, the DLL executed carries a rootkit - helping hide the infection from prying eyes.

What is of particular concern, of course, is that other malicious hackers might try to exploit the Windows Shortcut vulnerability as it would certainly be a useful tool in any malware's arsenal. The chances of that occurring has increased over the weekend, as a hacker called Ivanlef0u published proof-of-concept code onto the internet.

In the past we've seen worms (Conficker is perhaps the most famous example) spread successfully via USB devices, which prompted many firms to disable AutoPlay.

There is a real risk that more malware will take advantage of the zero-day exploit now the code is "out there", taking things to a whole new level.

So far, Microsoft has not made a patch available for the problem and has given no timeline as to when a proper fix will be available. However, I'm sure they are feverishly working on a security update for this critical vulnerability.

Sophos detects the malware we've seen so far using the exploit as W32/Stuxnet-B and Troj/Cplink-A.

, , , ,

You might like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley is an award-winning security blogger, and veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.