Microsoft on Tuesday said that hackers could exploit the unpatched Windows shortcut vulnerability using drive-by download attacks that would trigger an infection when people simply surf to a malicious Web site.
A noted vulnerability researcher today confirmed that such attacks are possible.
In the revised security advisory published yesterday Microsoft acknowledged the new attack vector.
"An attacker could also set up a malicious Web site or a remote network share and place the malicious components on this remote location," the company said in the advisory. "When the user browses the Web site using a Web browser such as Internet Explorer or a file manager such as Windows Explorer, Windows will attempt to load the icon of the shortcut file, and the malicious binary will be invoked."
That language was a change from earlier statements by Microsoft, which had said that attackers could hijack Windows PC by setting up a remote network share, a much more complicated task than building a malware-spreading Web site. In the earlier advisory, Microsoft also said that "the malicious binary may be invoked; the most recent warning instead said "the malicious binary will be invoked [emphasis added in both cases].
Last Friday, Microsoft confirmed that Windows contained a flaw in the parsing of shortcut files, the small files displayed by icons on the desktop, on the toolbar and in the Start menu that launch applications and documents when clicked. By crafting malicious shortcuts, hackers could automatically execute malware whenever a user viewed the shortcut or the contents of a folder containing the malevolent shortcut.
All versions of Windows are at risk, including the recently retired-from-support Windows XP SP2 and Windows 2000.
So far, attacks exploiting the bug appear to be limited to targeted assaults against software that manages large-scale industrial control systems in major manufacturing and utility companies. Siemens AG has confirmed that one of its customers , a German manufacturer it declined to name, had been victimized by an attack exploiting the shortcut bug.
If drive-by attacks can be launched using the vulnerability, it will be relatively easy for other hackers to join the party and expand attacks to the general PC population. Most security experts consider drive-by attacks among the most dangerous of all threats, since they require only that users be duped into browsing to a malicious site or a legitimate site that's been compromised.
HD Moore, the chief security officer of Rapid7 and the creator of the well-known Metasploit hacking toolkit, confirmed that drive-by attacks are feasible in some situations.
After additional testing and tweaking of an exploit that was added to Metasploit earlier this week, Moore said he was able to conduct drive-by attacks that leveraged the shortcut flaw. But there are some caveats, he said in several e-mailed replies to Computerworld's questions.
"IE8 still requires confirmation before going from Internet zone to [a] WebDAV share," he said, referring to an Internet Explorer security setting. "It is an easy drive-by on IE6, but there is still user interaction with newer versions of IE."
The attack doesn't work when users browse with Mozilla's Firefox or Google 's Chrome, Moore said.
He also spotted different results that varied by the version of Windows running the PC, echoing comments from other researchers that drive-by attacks using IE6, IE7, IE8 and IE9 were successful on Windows XP, but not on the newer Windows 7 . "It looks like Windows 7 has some additional magic which creates a pop-up [warning], and I suspect Vista is the same," said Moore.
Also on Tuesday, Microsoft admitted that shortcut-based exploits could be embedded into Office documents, which would likely be delivered as e-mail attachments.
Microsoft promised to patch the problem, but has given no hint about when it will complete that work. The next regularly scheduled security updates are due to ship on Aug. 10.
In lieu of a patch, Microsoft has recommended that users disable the displaying of shortcuts in Windows. Yesterday it published an automated "Fix it" tool that lets users switch off shortcuts with a single click.
However, that advice effectively cripples the computer, something Microsoft acknowledged when it said turning off shortcuts would "impact usability" of the machine. Disabling shortcut transforms the usual graphical icons on the desktop and elsewhere into generic white icons, making it impossible for users to tell at a glance which will launch IE, and which represents a Microsoft Word document.
Moore remained confident that Microsoft would be able to quickly patch the problem, perhaps within two weeks.
"The core issue may be as simple as passing the LOAD_LIBRARY_AS_IMAGE_RESOURCE flag into the LoadLibrary() call used to map the DLL in order to extract the [shortcut] icon," he explained in another e-mail. "The question is whether the API used needs more than 'resource-only' access in order to function properly."
Users can access the Fix it tool that disables shortcuts from Microsoft's support site.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com .
Read more about security in Computerworld's Security Topic Center.