Yellow alert over Windows shortcut flaw
'Wide-scale exploitation is only a matter of time'
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Windows Shortcut's zero-day attack code has gone public.
The development increases the risk that the attack vector, already used by the highly sophisticated Stuxnet Trojan to attack Scada control systems, will be applied against a wider range of vulnerable systems.
All versions of Windows are potentially vulnerable to the exploit.
Just viewing the contents of an infected USB stick is enough to get pwned, even on systems where Windows Autoplay is disabled. Maliciously-crafted Windows shortcut (.lnk) files might also to be able to push malicious code through other attack routes left open by the vulnerability, such as Windows shares.
The SANS Institute's Internet Storm Centre has responded to the heightened threat by moving onto yellow alert status for the first time in years. "We believe wide-scale exploitation is only a matter of time," writes ISC handler Lenny Zeltser.
"The proof-of-concept exploit is publicly available, and the issue is not easy to fix until Microsoft issues a patch. Furthermore, anti-virus tools' ability to detect generic versions of the exploit have not been very effective so far."
Microsoft has acknowledged the problem - and published workarounds designed to guard against attack - ahead of a possible patch. Going by previous form, and given the seriousness of the flaw and the amount of platforms affected, Microsoft's security gnomes will have their work cut out to release a fix as part of August's Patch Tuesday much less any sooner.
The Siemens SIMATIC WinCC SCADA systems specially targeted by the Stuxnet Trojan use hard-coded admin username / password combinations that users are told not to change. Details of these passwords has been available on underground hacker forums for at least two years, Wired reports.
Worse still, changing Siemens' hard-coded password will crash vulnerable SCADA systems, IDG reports. Siemens is in the process of developing guidelines for customers on how to mitigate against the risk of possible attack.
An overview of the vulnerability and its implications can be found in a blog posting by Rik Ferguson of Trend Micro here. ®
COMMENTS
Utter muppets
WTF?
"The Siemens SIMATIC WinCC SCADA systems...use hard-coded admin username / password combinations that users are told not to change...changing Siemens' hard-coded password will crash vulnerable SCADA systems"
You could not make that up! Using Windows, with its Swiss cheese history of security holes, is bad enough, but actually designing a system where the #1 rule of security (Thou shall not use well known user/password that world+dog knows) is deliberately broken!
Siemens should be hauled over red hot coals for that one. Fail for Windows, and fail for the muppet approach to security on systems that are intended for critical applications.
Step it up to red alert
"Sir, are you absolutely sure? It does mean changing the bulb."
Actually you're wrong
"Didn't Microsoft rewrite Windows from the ground up to make it more secure at around the time Vista was released?"
Err no. "
Wrong, M$ put a LOT of effort into making it more secure....with the Protected Media Path, DRM, and WGA/WAT, and other goodies to secure the system from the user, Fair Use and the Doctrine of First Sale (and to suck up to the RIAA, MPAA, BSA, etc). But nevermind about external threats....
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
