Skip to main content

Microsoft Confirms Zero-Day ''Shortcut'' Exploit

Friday Microsoft confirmed a zero-day exploit that is associated with using an infected USB flash drive on systems with Windows XP SP2 up to Windows 7. Apparently researchers have warned Microsoft about the exploit for a little over a month.

According to the company, hackers are exploiting a bug in Windows "shortcut" files. "The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut," the company said.

For consumers who have AutoPlay disabled, they would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.

"In the wild, this vulnerability has been found operating in conjunction with the Stuxnet malware, a threat family already known to the Microsoft Malware Protection Center," said Dave Forstrom, a director in Microsoft's Trustworth group. "The MMPC has a blog post with more technical discussion of Stuxnet."

Until Microsoft addresses the exploit in a patch, the company suggests that users disable the displaying of icons for shortcuts. This means that consumers will need to edit the HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler key in the registry. Although this shouldn't be a problem for knowledged users, inexperienced consumers could make the problem worse.

"This is highly impractical for most environments," said Chester Wisniewski, a senior security advisory with Sophos. "While it would certainly solve the problem, it would also cause mass confusion among many users and might not be worth the support calls."

The exploit problem gets worse. Sunday a security researcher known as "Ivanlef0u" published proof-of-concept code on the Internet that takes advantage of the exploit. When tweaked, the code could be used in an effective attack.

Belgian researcher Didier Stevens created a tool to combat against the shortcut security flaw, however he warns that inexperienced users shouldn't install it. The tool and notes can be found here.

  • dameon51
    Another fix for this would be don't let untrustworthy individuals have access to your computer.
    Reply
  • dogofwars
    Ha another day another dollars in this industry of piracy. It's just same old same old it just never stop.........
    Reply
  • obiown77
    And they are just announcing/addressing this now, this exploit has been a big pain in the ass at work for months, I've had tons of users using there usb keys, and infecting crap.
    Reply
  • gaevs
    This only applies to Windows XP, 7 has autorun disabled, so no clients had this problem.. just let XP die..
    Reply
  • noodlegts
    Microsoft should be paying potential hackers to find these problems instead of letting the Chinese or Terrorists or people with too much time on their hands find them, and then coming up with fixes.

    I think all in all it will be cheaper and make for a safer environment for everyone.

    Just my two cents.
    Reply
  • RE: just let XP die
    why should it die? XP still has the best 2D performance - look it up!!!

    http://endlessjukebox.com?afid=216
    Reply
  • pixelpusher220
    @gaevs:
    from the article
    "For consumers who have AutoPlay disabled, they would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited."
    .
    Seems to me if a user put a USB in their computer, one *very* likely scenario is browsing the USB to see what is on it. It affects XP SP2 to Win7 whether you want to admit it or not. ;-)
    Reply
  • mavroxur
    obiown77And they are just announcing/addressing this now, this exploit has been a big pain in the ass at work for months, I've had tons of users using there usb keys, and infecting crap.
    But normally, the infection comes from what the autorun is launching, not the autorun shortcut itself.



    gaevsThis only applies to Windows XP, 7 has autorun disabled, so no clients had this problem.. just let XP die..

    Um... no it doesnt.
    Reply
  • wait let me get this right.... for this to work someone has to physically plug the thing into my USB port.... the last time i let a stranger do that was.....
    Reply
  • Gin Fushicho
    What Noodlegts said, and as well, I think Microsoft should stop pouring so much time into XP, they said they were going to let it die, and now they've changed their minds.
    Reply