Tuesday, July 27, 2010

New Found Windows Security Flaws Attack Shortcuts

Microsoft late Tuesday released an automated tool to stymie exploits of a critical unpatched Windows vulnerability that experts fear will soon be used by hackers against the general PC population. According to the security advisory issued Friday by Microsoft , hackers can use a malicious shortcut file, identified by the ".lnk" extension, to automatically run their malware simply by getting a user to view the contents of a folder containing the shortcut. Malware can also automatically execute on some systems when a USB drive is plugged into the PC.

However, the tool, like a manual procedure that Microsoft recommended last week, is only a makeshift defense, one that many users may resist applying since it makes much of Windows, including the desktop, taskbar, and Start menu, almost unusable.

The company posted a "Fix it" tool on its support site that automatically disables the displaying of all Windows shortcut files. Microsoft stepped users through the same technique last week in its initial security advisory, but told them then that they had to edit the Windows registry. Most Windows users are reluctant to monkey with the registry, since a single error can cripple the computer.

Microsoft's single-click Fix it tool simply automates that process. Users must reboot their machines after applying the workaround, but IT administrators can configure the tool to install it while users are out of the office or not at their PCs.

The company admitted that applying the Fix it or the registry-editing workaround would "impact usability" of the machine since both transform the usual graphical icons on the desktop and elsewhere into generic white icons, making it impossible to tell at a glance which represents Internet Explorer, and which stands for, say, Microsoft Word.

Microsoft also revised its security advisory, originally published last Friday, to tell corporate administrators that they could defend against attacks by also blocking downloads of shortcut files -- identified by the ".lnk" extension -- and ".pif" files at the network perimeter.

The Windows shortcuts vulnerability was first described more than a month ago by VirusBlokAda, a little-known security firm based in Belarus, but first attracted widespread attention after security blogger Brian Krebs reported on it last Thursday. A day later, Microsoft confirmed the bug and admitted that small-scale attacks were already exploiting the flaw.

All versions of Windows, including the just-released beta of Windows 7 Service Pack 1 (SP1), as well as the recently retired Windows XP SP2 and Windows 2000, contain the bug.

View Full Article

Add to FacebookAdd to DiggAdd to Twitter