Microsoft issues tool to repel Windows shortcut attacks
Like manual workaround recommended last week, it leaves Windows nearly unusable
Computerworld - Microsoft Corp. late Tuesday released an automated tool to stymie exploits of a critical unpatched Windows vulnerability that experts fear will soon be used by hackers against the general PC population.
However, the tool, like a manual procedure that Microsoft recommended last week, is only a makeshift defense, one that many users may resist applying, since it makes much of the Windows system, including the desktop, taskbar and Start menu, almost unusable.
The company posted a "Fix It" tool on its support site that automatically disables the displaying of all Windows shortcut files. Microsoft stepped users through the same technique last week in its initial security advisory, but at that time it told them that they had to edit the Windows registry. Most Windows users are reluctant to monkey with the registry, since a single error can cripple a computer.
Microsoft's single-click Fix It tool simply automates that process. Users must reboot their machines after applying the work-around, but IT administrators can configure the tool to install it while users are out of the office or not at their PCs.
The company admitted that applying the Fix It or the registry-editing work-around would "impact usability" of the machine, since both transform the usual graphical icons on the desktop and elsewhere into generic white icons, making it impossible to tell at a glance which represents say, Internet Explorer, and which stands for Microsoft Word.
Microsoft also revised its security advisory, originally published last Friday, to tell corporate administrators that they could defend against attacks by also blocking downloads of shortcut files -- identified by the ".lnk" extension -- and ".pif" files at the network perimeter.
The Windows shortcuts vulnerability was first described more than a month ago by VirusBlokAda, a little-known security firm based in Belarus. But it only began to attract widespread attention after security blogger Brian Krebs reported on it last Thursday. A day later, Microsoft confirmed the bug and admitted that small-scale attacks were already exploiting the flaw.
All versions of Windows contain the vulnerability, including the preview of Windows 7 Service Pack 1 (SP1), and the recently retired-from-support Windows XP SP2 and Windows 2000.
Hackers can craft malicious shortcut files that in turn automatically execute malware whenever a user simply views the contents of a folder containing the malformed shortcut. Initial reports noted that attacks were using infected USB drives to hijack Windows PCs running Siemens software that manages large-scale industrial control systems in major manufacturing and utility companies.
Siemens AG has confirmed that one of its customers, a German manufacturer it declined to name, had been victimized by an attack exploiting the shortcut bug.
Microsoft has promised to patch the problem, but it has yet to name a date. The next regularly scheduled security updates are due to ship in less than three weeks, on Aug. 10.
Researchers are split over Microsoft's expected timetable. But the Tuesday release of the Fix It tool is little help in parsing Microsoft's plans. The company released a similar tool in mid-June for a zero-day vulnerability that went public the day before, but it waited 32 days after that to deliver a patch. In March, however, Microsoft patched a critical Internet Explorer vulnerability just 18 days after issuing a Fix It to block attacks.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts