Microsoft Confirms Zero-Day ''Shortcut'' Exploit
There's a shortcut exploit affecting all versions of Windows from XP SP2 to Windows 7
Friday Microsoft confirmed a zero-day exploit that is associated with using an infected USB flash drive on systems with Windows XP SP2 up to Windows 7. Apparently researchers have warned Microsoft about the exploit for a little over a month.
According to the company, hackers are exploiting a bug in Windows "shortcut" files. "The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut," the company said.
For consumers who have AutoPlay disabled, they would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.
"In the wild, this vulnerability has been found operating in conjunction with the Stuxnet malware, a threat family already known to the Microsoft Malware Protection Center," said Dave Forstrom, a director in Microsoft's Trustworth group. "The MMPC has a blog post with more technical discussion of Stuxnet."
Until Microsoft addresses the exploit in a patch, the company suggests that users disable the displaying of icons for shortcuts. This means that consumers will need to edit the HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler key in the registry. Although this shouldn't be a problem for knowledged users, inexperienced consumers could make the problem worse.
"This is highly impractical for most environments," said Chester Wisniewski, a senior security advisory with Sophos. "While it would certainly solve the problem, it would also cause mass confusion among many users and might not be worth the support calls."
The exploit problem gets worse. Sunday a security researcher known as "Ivanlef0u" published proof-of-concept code on the Internet that takes advantage of the exploit. When tweaked, the code could be used in an effective attack.
Belgian researcher Didier Stevens created a tool to combat against the shortcut security flaw, however he warns that inexperienced users shouldn't install it. The tool and notes can be found here.
I think all in all it will be cheaper and make for a safer environment for everyone.
Just my two cents.
why should it die? XP still has the best 2D performance - look it up!!!
http://endlessjukebox.com?afid=216
from the article
"For consumers who have AutoPlay disabled, they would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited."
.
Seems to me if a user put a USB in their computer, one *very* likely scenario is browsing the USB to see what is on it. It affects XP SP2 to Win7 whether you want to admit it or not. ;-)
But normally, the infection comes from what the autorun is launching, not the autorun shortcut itself.
Um... no it doesnt.
the issue isnt with Autorun
All you would have to do is navigate to the folder that has the infected file (link) in it.
How? Delete it?
How were they getting those drives infected in the first place?
I know it is much harder to build one than destroy one... but after so many patches/years/OS generations... we are still finding more holes to fix... hmmm...