Feeds

Yellow alert over Windows shortcut flaw

'Wide-scale exploitation is only a matter of time'

Secure remote control for conventional and virtual desktops

Windows Shortcut's zero-day attack code has gone public.

The development increases the risk that the attack vector, already used by the highly sophisticated Stuxnet Trojan to attack Scada control systems, will be applied against a wider range of vulnerable systems.

All versions of Windows are potentially vulnerable to the exploit.

Just viewing the contents of an infected USB stick is enough to get pwned, even on systems where Windows Autoplay is disabled. Maliciously-crafted Windows shortcut (.lnk) files might also to be able to push malicious code through other attack routes left open by the vulnerability, such as Windows shares.

The SANS Institute's Internet Storm Centre has responded to the heightened threat by moving onto yellow alert status for the first time in years. "We believe wide-scale exploitation is only a matter of time," writes ISC handler Lenny Zeltser.

"The proof-of-concept exploit is publicly available, and the issue is not easy to fix until Microsoft issues a patch. Furthermore, anti-virus tools' ability to detect generic versions of the exploit have not been very effective so far."

Microsoft has acknowledged the problem - and published workarounds designed to guard against attack - ahead of a possible patch. Going by previous form, and given the seriousness of the flaw and the amount of platforms affected, Microsoft's security gnomes will have their work cut out to release a fix as part of August's Patch Tuesday much less any sooner.

The Siemens SIMATIC WinCC SCADA systems specially targeted by the Stuxnet Trojan use hard-coded admin username / password combinations that users are told not to change. Details of these passwords has been available on underground hacker forums for at least two years, Wired reports.

Worse still, changing Siemens' hard-coded password will crash vulnerable SCADA systems, IDG reports. Siemens is in the process of developing guidelines for customers on how to mitigate against the risk of possible attack.

An overview of the vulnerability and its implications can be found in a blog posting by Rik Ferguson of Trend Micro here. ®

Remote control for virtualized desktops

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.