Shortcut zero-day attack code goes public

If you've been following Chet Wisniewski's articles over the last few days you will already know about the serious zero-day vulnerability that has been found in versions of Windows.

Since confirmed by Microsoft, there exists a vulnerability in versions of Windows which allows a maliciously-crafted Windows shortcut file (.lnk) run a malicious DLL file, simply by being viewed on a USB stick.

Furthermore, the attack can be initiated automatically by viewing an affected USB storage device via Windows Explorer, even with AutoRun and AutoPlay are disabled. The Microsoft Security Response Center (MSRC) says that the security hole can also be remotely exploited via WebDAV and network shares.

You can watch the following YouTube video where Chet shows the attack in action:

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

In this case, the DLL executed carries a rootkit - helping hide the infection from prying eyes.

What is of particular concern, of course, is that other malicious hackers might try to exploit the Windows Shortcut vulnerability as it would certainly be a useful tool in any malware's arsenal. The chances of that occurring has increased over the weekend, as a hacker called Ivanlef0u published proof-of-concept code onto the internet.

In the past we've seen worms (Conficker is perhaps the most famous example) spread successfully via USB devices, which prompted many firms to disable AutoPlay.

There is a real risk that more malware will take advantage of the zero-day exploit now the code is "out there", taking things to a whole new level.

So far, Microsoft has not made a patch available for the problem and has given no timeline as to when a proper fix will be available. However, I'm sure they are feverishly working on a security update for this critical vulnerability.

Sophos detects the malware we've seen so far using the exploit as W32/Stuxnet-B and Troj/Cplink-A.