Developing Situation!!! - Windows LNK exploit.

[Sludge3000]

I should have posted this yesterday after I had read the analysis on the securelist blog (linked at the bottom) but wasn't sure if it was news worthy or just a write up on the malware . It's a previously unknown secuirty weakness and is now being investigated by multiple security researchers as well as Microsoft.

Hackers have developed malware that spreads via USB sticks using a previously unknown security weakness involving Windows' handling of shortcut files.

Malware targeting the security weakness in the handling of 'lnk shortcut files has been spotted in the wild by Belarus-based security firm VirusBlokAda. The malware uses rootkit-style functionality to mask its presence on infected systems. These rootlet drivers come digitally signed by legitimate software developer Realtek Semiconductor, a further mark of the sophistication of the attack.

Story @ the Register
VirusBlokAda advisory

The write up by Kaspersky can be found below and is in three parts under the title of Myrtus and Guava.
Securlist Blog

[Wingman]

Some additional info...

VirusBlokAda Anti-virus
Identifies Rootkit.TmpHider (Trojan-Spy.0485 and Malware-Cryptor.Win32.Inject.gen.2) that uses digitally signed signatures and has the ability to infect 64-bit systems.

The infection installs two drivers (signed with digital signature of Realtek Semiconductor Corp): mrxnet.sys and mrxcls.sys, which are used to inject code into systems processes and hide itself.

Rootkit.TmpHider: Trojan-Spy.0485 and Malware-Cryptor.Win32.Inject.gen.2 Review

[Sludge3000]

Microsoft have now released a zero day advisory regarding this issue and have suggested possible workarounds until the vulnerability has been patched.

Microsoft is investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell, a component of Microsoft Windows. This advisory contains information about which versions of Windows are vulnerable as well as workarounds and mitigations for this issue.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut. This vulnerability is most likely to be exploited through removable drives. For systems that have AutoPlay disabled, customers would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.

Story @ The Register
Microsoft Security Advisory

[Sludge3000]

This vulnerability has now been escalated at the SANS Internet Storm Center to Yellow alert status, the first time a yellow alert has been in action for years!

Internet Storm Center
Story @ The Register

[Sludge3000]

UPDATE:

Microsoft has published an automated workaround for the newly discovered Windows vulnerability that criminals are exploiting to seize control of computers, including some used to manage sensitive equipment at power plants and other industrial facilities.

The software giant began distributing the Fix It on Tuesday evening, five days after the vulnerability in every supported version of Windows became widely known. It automatically changes operating-system settings to protect users until a permanent patch is available. Previously, users had to make the changes manually, a process that risked bricking a PC in the event it wasn't carried out correctly.

Story @ The Register
Microsoft 'Fix It'

[Sludge3000]

UPDATE:
Siemens are distributing SysClean by Trend Micro to their business customers who use their SCADA systems in an attempt to remove the Stuxnet rootkit.

Siemens has made a program available for detecting and disinfecting malware attacking its software used to control power grids, gas refineries, and factories but warned customers who use it could disrupt sensitive plant operations.

The Munich-based engineering company on Thursday began distributing Sysclean, a malware scanner made by Trend Micro. It has been updated to remove Stuxnet, a worm that spreads by exploiting two separate vulnerabilities in Siemens's SCADA, or supervisory control and data acquisition, software and every supported version of Microsoft Windows.

Story @ The Register


UPDATE:
The Chymine-A Trojan and the Autorun-VB-RP worm have been found to be exploiting this vulnerability ITW.

Virus writers have begun using the unpatched shortcut flaw in Windows first exploited by the Stuxnet worm, which targets power plant control systems, to create malware that infects the general population of vulnerable Windows machines.

Slovakian security firm Eset reports the appearance of two malware strains that exploit security vulnerabilities in the way Windows handles .lnk (shortcut) files, first used by Stuxnet to swipe information from Windows-based SCADA systems from Siemens.

Story @ The Register
Blog Post @ ESET

FOR INFO:
Check out the Kaspersky blog linked below. They currently have a couple of articles up regarding the Realtek certificates now being revoked however a new varient is using a certificate assigned to JMicron Technology Corp.

Kaspersky Blog

[Sludge3000]

UPDATE:

An exploit can also be included in specific document types that support embedded shortcuts.

As such we are likely to see infected documents being sent out by spam in an aim to maximise the contact with this vulnerability.

Blogpost @ F-Secure

[Sludge3000]

Miscreants behind the Zeus cybercrime toolkit and other strains of malware have begun taking advantage of an unpatched shortcut handling flaws in Windows. It was first used by a sophisticated worm to target SCADA-based industrial control and power plant systems.

Isolated strains of mainstream malware that took advantage of how the zero-day Windows flaw first exploited by the sophisticated Stuxnet worm began appearing late last week. The same approach has since been applied by the dodgy sorts behind Zeus, a family of sophisticated toolkits frequently used to steal bank login credentials and the like from compromised systems.

Zeus and Sality have both been confirmed as exploiting this vulnerability as well as other malware. Keep your eyes out guys. Sophos have released a free vendor-neutral tool for preventing exploitation.

Story @ The Register
Windows Shortcut Exploit Protection Tool by Sophos

EDIT: Renamed topic to better reflect the content and ongoing development of the issue.

[Gary R]

Patch available.

http://www.microsoft.com/technet/securi ... 0-046.mspx