Printable View
ISC (SANS) have raised their threat level to yellow, which to me is a good sign that this issue will be exploited in mass effect soon.
Please go through, if you manage Information Systems Security in Enterprise environment:
http://www.microsoft.com/technet/sec...y/2286198.mspx
http://krebsonsecurity.com/2010/07/e...shortcut-flaw/
Looks like it's getting into the wild:
http://www.zdnet.co.uk/news/security...575/?s_cid=938
Quote:
The malware, which has been labelled 'Stuxnet' by security researchers, has been seen in the wild in India, Iran, the US and Indonesia,
"India"
I think its time i take a vacation.
The worst is that Microsoft is giving the exploit the cold shoulder >.<
So let me get this straight...
The advisory is that shortcuts execute files? O RLY?!?!
Make way, citizens, Captian Obvious to the rescue!!
I think it has more to do with the icon than with the shortcut.Quote:
Originally Posted by The-Spec
from nihil's link:
From the MS advisory:Quote:
Microsoft said that Stuxnet could allow an attacker to take control of a system, and it is investigating the malware. In the meantime, IT professionals can disable shortcut icons to mitigate the threat, the company advised.
So yes, the shortcuts do execute files, but the icons are not supposed to execute code when they are simply viewed.Quote:
The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the icon of a specially crafted shortcut is displayed.
What makes this exploit really scary in my opinion is when it is coupled with drive-by downloads/xss. Browsers are already insecure enough as it is, now say a user visits a malicious page which then downloads a malicious .lnk file. A lot of browsers open up a download window which can then lets the .lnk to run rampant on the machine. It could then execute a shatter attack or some other escalation privilege attack and pretty much root the system right then and there.
It looks like Microsoft is telling people to disable .lnk and .pif files until everything is made kosher once again and has even provided a tool to help users disable them. That sure is nice of them considering their first stance was "Oh, it isn't THAT big of a deal!"
Yeah, assuming you've already accepted it as a download and the file menu doesn't automaticly close before displaying the file. At that point why not just link people to an executable and flat-out ask people to run it as admin.Quote:
A lot of browsers open up a download window which can then lets the .lnk to run rampant on the machine.
Have you ever even heard of a drive-by downloading attack T-spec? You don't need the user permission to download the file in case you haven't. Once it is there, most browsers will have it open automatically by default, if they don't, more than likely they will download something and then you have them less they just want to keep their download sitting there......... I honestly don't know whether or not I should take your post seriously though.....
Your response would be fine and dandy if it had any relivance to the subject at hand... or would even fit into whatever point your trying to make.
This flaw isn't going to have the effect of lets say... adobe products. And explorer itself couldn't be effected remotely since it uses default icons as a represention of files that aren't directly located on the drive. It would have to already be on disk and displayed within a file menu to take any sort of effect.
:spit:ZIIIING... Sorry but i find this very very very very amusing.
Quote:
Originally Posted by SnugglesTheBear
Upon reading http://www.microsoft.com/technet/sec...y/2286198.mspx, the link states the following under the faq and I quote "How could an attacker exploit the vulnerability?Quote:
Originally Posted by The-Spec
An attacker could present a removable drive to the user with a malicious shortcut file, and an associated malicious binary. When the user opens this drive in Windows Explorer, or any other application that parses the icon of the shortcut, the malicious binary will execute code of the attacker’s choice on the victim system.
An attacker could also set up a malicious Web site or a remote network share and place the malicious components on this remote location. When the user browses the Web site using a Web browser such as Internet Explorer or a file manager such as Windows Explorer, Windows will attempt to load the icon of the shortcut file, and the malicious binary will be invoked. In addition, an attacker could embed an exploit in a document that supports embedded shortcuts or a hosted browser control (such as but not limited to Microsoft Office documents). "
I do believe the attack I describe fits within the scope of the second paragraph.
*runs to get popcorn* :D :drink:
LOL, am I the only one pissing myself laughing? Come on, people have been bashing Microsoft for security since... Well, long before I came along to take the torch and haz burnination lol.
Remember when you had to actually open an email, download the attachment, and then run the thing the idiot who sent it to you named "Yea suck on this *******.exe" lol.
Good times... Apparently you can't even double click anymore! Oh no! I wonder if Apple will make some more of those idiotic ads they love so much about how Mac's only have one button and that might make them safer. And of course how "PC" was always sick with a virus and told Mac to get away and he'd be a jack ass and say he couldn't be infected. Man these people....
Its not something that would "show up on a web page". And when you connect to shared directorys in IE it uses the default icons associated with these files. Browsers haven't automaticly opened word documents and pdf files since 1998.
Why try to up-play this to the point of outright lies?
Hummm.......
[["drive-by"]["road apples"]]
I'd like extra butter on mine, Westin!
If you are a M$ shop and you host your Exchange server and your Domain is 2000 or above (If you're still NT then stop reading and go out back and quietly shoot yourself)
This statement should be true even if you learned networking from Jim Bobs School of Networking and Fish and Tackle Supplies:
It is impossible to send .lnk files in email and when you insert any removable drive or a CD/DVD into a computer NOTHING HAPPENS. (Cause autorun is disabled)
AD Policies people - AD Policies.
Yea and screw the home user. You picked up the road apple you clean it up.
Maybe I was not clear on how the attack would execute and thus the source of the argument. >.< What I was trying to state was that a malicious website has the victim download unknowingly two components onto the victims machine, the .exe and the .lnk. When the victim navigates(or in some circumstances if the browser automatically opens up the folder) to his/her downloads folder or wherever they put it, the .lnk exploit will trigger and then the malicious .exe will execute. :/
I am sure this can be mitigated by not running\browsing\surfing as administrator....Quote:
the .lnk exploit will trigger and then the malicious .exe will execute. :/
MLF
Oh good! So only 99% or so of people are at risk as opposed to.. Oh... And, you know, pre-Windows 7 default installations having the Admin account logged in by default without any password whatsoever, and no user adding panel like other OSs, and the general "If you don't want to browse as admin, or do anything like that, well, you CAN do it, but since 99% of you in the Home Computer Market have no idea why, or how, a Computer works, or why, or how, you shouldn't do this, and instead of trying, we'll make the ADMIN account, log in not only as the default account, we won't put a password on that either, and if you do want to, all you have to do is get into the user and account area of Control Panel, and set a password, and make a user for yourself that isn't admin, even though you type your normal name to log in and..."....Quote:
Originally Posted by morganlefay
I can't imagine more than 2 or 3 people out of 3,000 even getting through half of that without saying screw it and leaving it alone.
I brought this up already and pointed it out, but just because Windows CAN be locked down, doesn't mean it is, and auto log in, though neat for those who don't care about a password.... It works great on Linux, where the Root account isn't the default by any means, and you have to add a non root user, and then you can have THAT account auto log in...
It's not that Auto Login is a terrible idea, I know why people like it, they don't have to do anything! It's like those days of Windows 9X where clicking on Cancel would let you in just as well as the password.... (Remember Profiles? Lol)....
In other words, sure, for those of us who know what we're doing with a Computer, this thing is probably crap, but for literally more than 90% of the Home Users? Pffft.
If the solution was as simple as "Well don't use the admin account" you'd be out of a job.
Its still dog doo-doo when it comes to permissions though. Your allowed to read, execute, and write (but not modify) almost anything you want as nobody. Under a guest account in windows your not given write access to anything at all.
ugh since when did this .lnk start needing an .exe ?
Most attacks first use an application or OS vulnerability to gain access to the machine....then upload the exe and\or other crap....thats my understanding anyway.
I have seen alot of infections lately where machines are becoming infected through the browsers because of plugins....acrobat reader and flash and all the other shite.....
MLF
Agree somewhat, but from the "Poc's" i've seen played with over the time of this thread it's just been via .js etc
the person visits the site with the <script> </ script> tags and the site then places a "Desktop Shortcut" ie somesite.Lnk onto the desktop. The victim then double clicks loads up the browser and then .js throws the malware onto the machine once the script has run behind the scene's.
any1 got an example of a malformed .Lnk pulling an .exe once loaded??? I would be very keen to take a look. :)
sorry if i'm making little or no sense, had a few to drink and only planed to reply to an e-mail but spotted a new reply and figured heeey why not. ;)
you don't need to double click the .lnk, simply viewing it executes the code crafted in it.Quote:
Originally Posted by HYBR|D
I think the stuxnet/Win32, the one that targeted the power plants not the less elegant version that is flying around, uploads a system driver called jmidebs.sys and some .exes. The other clunkier strain probably has some payload of .exes. You can probably find the binaries floating around some security researcher's blog >.<Quote:
Originally Posted by HYBR|D
OK, did you mean this is as in "Over the network" log ins? Or physically sitting? There's a bit of a difference there, because The "Guest Account" on Windows may not allow that, but what I was saying about clicking cancel and it working, you don't really need an account at all. And over a Network, who'd allow log ins for the Nobody account? The reason user Nobody can do anything is that it's how you start all the forks and things for Apache. You need to allow that account to write to SOME things, otherwise it wouldn't work right.Quote:
Originally Posted by The-Spec
Also, I think you're missing the fun that can be had by doing this:
chsh nobody /bin/rm
"chsh" doesn't actually require that the Shell you change for a user, be an actual Shell. That's how those admins write those little interfaces where everything when a user logs in, shows up in one of those custom menus. They couldn't do that if it HAD to be an actual shell. So technically, you could change the nobody account to have a command for a log in shell, and on top of that.... Between Linux and BSD, I know user nobody doesn't get to have actual log ins on MY machines. And in BSD I think it's by default user nobody can't log in.
This stuff is just as easy to change as "Turn of Automatic Log in" would be in Windows so it's not like it's any more of an issue. Besides, I've never seen someone actually use the nobody account to try much of anything since it doesn't have access to much. And of course you COULD put that thing in a Sandbox or a Jail.
Sophos have a free tool that is supposed to temporarily fix this issue?
http://www.sophos.com/security/topic/shortcut.html
WARNING:
I have yet to personally test this, so take the usual precautions;)
From the Internet Storm Center:Quote:
Originally Posted by nihil
CheersQuote:
Update 1: This tool currently only protects against LNK files and does not protect against PIF based exploits. It also does not protect against LNK files or targets stored on the local disk. Thanks to ISC reader Gerrit for the additional information.
Looks like MS is issuing an out of band patch. Though they aren't saying specifically what vulnerability it addresses.
http://threatpost.com/en_us/blogs/mi...ws-flaw-073110
Quote:
Microsoft will issue an out-of-band patch on Monday for a critical vulnerability in all of the current versions of Windows. The company didn't identify which flaw it will be patching, but the description of the vulnerability is a close match to the LNK flaw that attackers have been exploiting for several weeks now, most notably with the Stuxnet Malware.