Microsoft warns of Windows shortcut drive-by attacks

Hackers can exploit new zero-day by luring users to nasty sites

Microsoft on Tuesday said that hackers could exploit the unpatched Windows shortcut vulnerability using drive-by download attacks that would trigger an infection when people simply surf to a malicious Web site.

A noted vulnerability researcher today confirmed that such attacks are possible.

In the revised security advisory published yesterday Microsoft acknowledged the new attack vector.

"An attacker could also set up a malicious Web site or a remote network share and place the malicious components on this remote location," the company said in the advisory. "When the user browses the Web site using a Web browser such as Internet Explorer or a file manager such as Windows Explorer, Windows will attempt to load the icon of the shortcut file, and the malicious binary will be invoked."

That language was a change from earlier statements by Microsoft, which had said that attackers could hijack Windows PC by setting up a remote network share, a much more complicated task than building a malware-spreading Web site. In the earlier advisory, Microsoft also said that "the malicious binary may be invoked; the most recent warning instead said "the malicious binary will be invoked [emphasis added in both cases].

Last Friday, Microsoft confirmed that Windows contained a flaw in the parsing of shortcut files, the small files displayed by icons on the desktop, on the toolbar and in the Start menu that launch applications and documents when clicked. By crafting malicious shortcuts, hackers could automatically execute malware whenever a user viewed the shortcut or the contents of a folder containing the malevolent shortcut.

All versions of Windows are at risk, including the recently retired-from-support Windows XP SP2 and Windows 2000.

So far, attacks exploiting the bug appear to be limited to targeted assaults against software that manages large-scale industrial control systems in major manufacturing and utility companies. Siemens AG has confirmed that one of its customers , a German manufacturer it declined to name, had been victimized by an attack exploiting the shortcut bug.

If drive-by attacks can be launched using the vulnerability, it will be relatively easy for other hackers to join the party and expand attacks to the general PC population. Most security experts consider drive-by attacks among the most dangerous of all threats, since they require only that users be duped into browsing to a malicious site or a legitimate site that's been compromised.

HD Moore, the chief security officer of Rapid7 and the creator of the well-known Metasploit hacking toolkit, confirmed that drive-by attacks are feasible in some situations.

After additional testing and tweaking of an exploit that was added to Metasploit earlier this week, Moore said he was able to conduct drive-by attacks that leveraged the shortcut flaw. But there are some caveats, he said in several e-mailed replies to Computerworld's questions.

"IE8 still requires confirmation before going from Internet zone to [a] WebDAV share," he said, referring to an Internet Explorer security setting. "It is an easy drive-by on IE6, but there is still user interaction with newer versions of IE."

The attack doesn't work when users browse with Mozilla's Firefox or Google 's Chrome, Moore said.

He also spotted different results that varied by the version of Windows running the PC, echoing comments from other researchers that drive-by attacks using IE6, IE7, IE8 and IE9 were successful on Windows XP, but not on the newer Windows 7 . "It looks like Windows 7 has some additional magic which creates a pop-up [warning], and I suspect Vista is the same," said Moore.

Also on Tuesday, Microsoft admitted that shortcut-based exploits could be embedded into Office documents, which would likely be delivered as e-mail attachments.

Microsoft promised to patch the problem, but has given no hint about when it will complete that work. The next regularly scheduled security updates are due to ship on Aug. 10.

In lieu of a patch, Microsoft has recommended that users disable the displaying of shortcuts in Windows. Yesterday it published an automated "Fix it" tool that lets users switch off shortcuts with a single click.

However, that advice effectively cripples the computer, something Microsoft acknowledged when it said turning off shortcuts would "impact usability" of the machine. Disabling shortcut transforms the usual graphical icons on the desktop and elsewhere into generic white icons, making it impossible for users to tell at a glance which will launch IE, and which represents a Microsoft Word document.

Moore remained confident that Microsoft would be able to quickly patch the problem, perhaps within two weeks.

"The core issue may be as simple as passing the LOAD_LIBRARY_AS_IMAGE_RESOURCE flag into the LoadLibrary() call used to map the DLL in order to extract the [shortcut] icon," he explained in another e-mail. "The question is whether the API used needs more than 'resource-only' access in order to function properly."

Users can access the Fix it tool that disables shortcuts from Microsoft's support site.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityMicrosoftoperating systemssoftwareWindows

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments



Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Brand Post

Bitdefender 2018

Roam freely in the digital world. Critically acclaimed performance and security at your fingertips.

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?