Experts predict extensive attacks of Windows zero-day
Threat levels jump, but Microsoft not ready to say when it will patch shortcut bug
Computerworld - Security organizations today raised Internet threat levels to warn users that they expect widespread attacks using exploits of a just-acknowledged critical bug in all versions of Windows.
The Internet Storm Center (ISC) pushed its Infocon threat indicator to "Yellow," a rare move, while Symantec also bumped up the status of its ThreatCon barometer to "Elevated."
Today's shift by ISC was the first Yellow since July 2009, when the group alerted users of a vulnerability in Office Web Components, a set of ActiveX controls for publishing Microsoft Office content to the Web and for displaying that content in Internet Explorer (IE).
"The proof-of-concept exploit is publicly available, and the issue is not easy to fix until Microsoft issues a patch," said Lenny Zeltser, an ISC security analyst, as he explained the higher threat level. "Although we have not observed the vulnerability exploited beyond the original targeted attacks, we believe wide-scale exploitation is only a matter of time."
Last Friday, Microsoft confirmed that attackers can use a malicious shortcut file, identified by the ".lnk" extension, to automatically execute their malware by getting users to view the contents of a folder containing such a shortcut. Malware can also automatically execute on many systems when a USB drive is plugged into the PC.
All versions of Windows, including the just-released beta of Windows 7 Service Pack 1 (SP1), as well as the recently retired Windows XP SP2 and Windows 2000, contain the bug.
Many of the attacks spotted so far have been aimed at major manufacturing and utility companies. Last week, Siemens alerted customers of its Simatic WinCC management software that attacks using the vulnerability were targeting computers used to manage large-scale industrial control systems, often called SCADA, for "supervisory control and data acquisition."
Symantec also boosted its ThreatCon indicator from the usual Level 1 to Level 2, dubbed "Elevated." Like the ISC, Symantec said it made the move because of the advisory Microsoft issued Friday and the expectation of increased attacks.
"The Symantec DeepSight Team expects this issue to be incorporated by attackers to carry out remote drive-by download attacks in the wild," said Symantec on its ThreatCon page.
HD Moore, the chief security officer of Rapid7 and the creator of the well-known Metasploit hacking toolkit, said that it was unlikely the vulnerability would be used in classic drive-by attacks, as Symantec predicted. "The vulnerability is serious, but it's not as bad as a drive-by," Moore said, talking about the type of attacks that compromise computers when their users simply browse to a malicious site.
Companies will remain the most lucrative targets for exploits of the Windows shortcut bug, Moore bet, while consumers will likely be relatively safe. One reason: Newer browsers, such as Internet Explorer 8 (IE8), Firefox and Chrome, will shield consumers. IE6, however, which is still widely used in some businesses, does not.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!