Feeds

Microsoft issues stopgap fix for critical Windows flaw

'Fix It' for ailing shortcut vuln

Combat fraud and increase customer satisfaction

Microsoft has published an automated workaround for the newly discovered Windows vulnerability that criminals are exploiting to seize control of computers, including some used to manage sensitive equipment at power plants and other industrial facilities.

The software giant began distributing the Fix It on Tuesday evening, five days after the vulnerability in every supported version of Windows became widely known. It automatically changes operating-system settings to protect users until a permanent patch is available. Previously, users had to make the changes manually, a process that risked bricking a PC in the event it wasn't carried out correctly.

Microsoft security response communications lead Christopher Budd warned that the workaround disables icon icons from being displayed as usual and recommended admins carefully test the fix before deploying it widely. Specifically, the change will cause folder and file icons on the task bar and start menu to be stripped of their graphical representations, making them appear as generic, white boxes. The Fix It will also require machines to be rebooted.

The stopgap measure comes as security researchers have found new ways to exploit the the critical vulnerability. Microsoft says it can be remotely triggered through the local network file-sharing features or the WebDAV, or Web Distributed Authoring and Versioning, client service. The open-source Metasploit framework for penetration testers has added a plug-in that remotely exploits the vulnerability, making it easy for black-hat hackers to target the bug as well. Previously, researchers said the vulnerability could be spread only by viewing the contents of an infected USB stick.

The vulnerability resides in the way Windows handles shortcut icons. The operating system fails to adequately parse some parameters, it's possible to embed malicious code in them that is automatically executed when an icon is viewed.

Criminals are actively exploiting the bug in targeted attacks, Microsoft and others have said. According to IDG News, at least one customer of SCADA, or supervisory control and data acquisition, software offered by Siemens has been hit by a computer worm that exploits the Windows flaw. The malware takes control of the systems, which are used to manage highly sensitive equipment at nuclear facilities, manufacturing plants and other industrial settings.

While the attacks seen to date have been highly targeted, security watchers warn they soon could become widespread. Microsoft hasn't said when it plans to offer a fix. The company's next patch release isn't scheduled until August 10, but officials haven't ruled out issuing an emergency fix ahead of that date. ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.