Microsoft warns of Windows shortcut drive-by attacks
Hackers can exploit new zero-day by luring users to nasty sites
Computerworld - Microsoft on Tuesday said that hackers could exploit the unpatched Windows shortcut vulnerability using drive-by download attacks that would trigger an infection when people simply surf to a malicious Web site.
A noted vulnerability researcher today confirmed that such attacks are possible.
In the revised security advisory published yesterday Microsoft acknowledged the new attack vector.
"An attacker could also set up a malicious Web site or a remote network share and place the malicious components on this remote location," the company said in the advisory. "When the user browses the Web site using a Web browser such as Internet Explorer or a file manager such as Windows Explorer, Windows will attempt to load the icon of the shortcut file, and the malicious binary will be invoked."
That language was a change from earlier statements by Microsoft, which had said that attackers could hijack Windows PC by setting up a remote network share, a much more complicated task than building a malware-spreading Web site. In the earlier advisory, Microsoft also said that "the malicious binary may be invoked; the most recent warning instead said "the malicious binary will be invoked [emphasis added in both cases].
Last Friday, Microsoft confirmed that Windows contained a flaw in the parsing of shortcut files, the small files displayed by icons on the desktop, on the toolbar and in the Start menu that launch applications and documents when clicked. By crafting malicious shortcuts, hackers could automatically execute malware whenever a user viewed the shortcut or the contents of a folder containing the malevolent shortcut.
All versions of Windows are at risk, including the recently retired-from-support Windows XP SP2 and Windows 2000.
So far, attacks exploiting the bug appear to be limited to targeted assaults against software that manages large-scale industrial control systems in major manufacturing and utility companies. Siemens AG has confirmed that one of its customers, a German manufacturer it declined to name, had been victimized by an attack exploiting the shortcut bug.
If drive-by attacks can be launched using the vulnerability, it will be relatively easy for other hackers to join the party and expand attacks to the general PC population. Most security experts consider drive-by attacks among the most dangerous of all threats, since they require only that users be duped into browsing to a malicious site or a legitimate site that's been compromised.
HD Moore, the chief security officer of Rapid7 and the creator of the well-known Metasploit hacking toolkit, confirmed that drive-by attacks are feasible in some situations.
After additional testing and tweaking of an exploit that was added to Metasploit earlier this week, Moore said he was able to conduct drive-by attacks that leveraged the shortcut flaw. But there are some caveats, he said in several e-mailed replies to Computerworld's questions.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!