Feeds

Unpatched shortcut vuln exploited by mainstream malware

'Bottom feeders' latch onto zero-day bug

Providing a secure and efficient Helpdesk

Virus writers have begun using the unpatched shortcut flaw in Windows first exploited by the Stuxnet worm, which targets power plant control systems, to create malware that infects the general population of vulnerable Windows machines.

Slovakian security firm Eset reports the appearance of two malware strains that exploit security vulnerabilities in the way Windows handles .lnk (shortcut) files, first used by Stuxnet to swipe information from Windows-based SCADA systems from Siemens.

The Chymine-A Trojan uses the same security hole to install a keystroke logger while the Autorun-VB-RP worm has been updated to use the shortcut vulnerability as an infection method. The original hackers developed a technique to embed malicious code in shortcut files in such a way that this code is run when an icon is viewed, an approach now followed by less skilled VXers.

Stuxnet featured rootlet functionality and digitally signed malware, techniques that mark it out as highly sophisticated. The latest malware to use the shortcut vulnerability is, by contrast, much more basic.

"The new malware we're seeing is far less sophisticated, and suggests bottom feeders seizing on techniques developed by others," writes Pierre-Marc Bureau, a senior researcher at Eset, in a blog post.

The shortcut vulnerability is likely to become a mainstay of malware distribution techniques, Bureau warns.

"This new development follows a typical path of evolution in malware.  Often there are only days between the initial release of information regarding a critical vulnerability, and the discovery of its exploitation being executed in the wild by malware authors.  It is safe to assume that more malware operators will start using this exploit code in order to infect host systems and increase their revenues," he concludes.

Trend Micro warns that the hole can be exploited by a wide variety of techniques including network shares, malicious websites and booby-trapped Office documents, as well as USB drive infection, the technique associated with the Stuxnet worm.

"File formats that support embedded shortcuts (eg Microsoft Office documents) can now be used to spread exploits as well," writes Trend Micro threat researcher David Sancho. "This means that users who download and open such files could find themselves the latest victim of this vulnerability. It has also been reported that this attack could be used in drive-by attack scenarios, further increasing risks."

Microsoft has issued temporary workarounds and security advice to customers as a stop-gap measure while its security researchers work on developing a fix. The vulnerability involves a security hole in core Windows functionality, so developing and testing a patch by the next scheduled Patch Tuesday, 10 August, will be tricky but not out of the question. Redmond's security team will have had a month by this point to go through a process that more typically takes two months or longer. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.