Microsoft warns of Windows shortcut drive-by attacks

Hackers can exploit new zero-day by luring users to nasty sites

Microsoft on Tuesday said that hackers could exploit the unpatched Windows shortcut vulnerability using drive-by download attacks that would trigger an infection when people simply surf to a malicious Web site.

A noted vulnerability researcher today confirmed that such attacks are possible.

In the revised security advisory published yesterday Microsoft acknowledged the new attack vector.

"An attacker could also set up a malicious Web site or a remote network share and place the malicious components on this remote location," the company said in the advisory. "When the user browses the Web site using a Web browser such as Internet Explorer or a file manager such as Windows Explorer, Windows will attempt to load the icon of the shortcut file, and the malicious binary will be invoked."

That language was a change from earlier statements by Microsoft, which had said that attackers could hijack Windows PC by setting up a remote network share, a much more complicated task than building a malware-spreading Web site. In the earlier advisory, Microsoft also said that "the malicious binary may be invoked; the most recent warning instead said "the malicious binary will be invoked [emphasis added in both cases].

Last Friday, Microsoft confirmed that Windows contained a flaw in the parsing of shortcut files, the small files displayed by icons on the desktop, on the toolbar and in the Start menu that launch applications and documents when clicked. By crafting malicious shortcuts, hackers could automatically execute malware whenever a user viewed the shortcut or the contents of a folder containing the malevolent shortcut.

All versions of Windows are at risk, including the recently retired-from-support Windows XP SP2 and Windows 2000.

So far, attacks exploiting the bug appear to be limited to targeted assaults against software that manages large-scale industrial control systems in major manufacturing and utility companies. Siemens AG has confirmed that one of its customers , a German manufacturer it declined to name, had been victimized by an attack exploiting the shortcut bug.

If drive-by attacks can be launched using the vulnerability, it will be relatively easy for other hackers to join the party and expand attacks to the general PC population. Most security experts consider drive-by attacks among the most dangerous of all threats, since they require only that users be duped into browsing to a malicious site or a legitimate site that's been compromised.

HD Moore, the chief security officer of Rapid7 and the creator of the well-known Metasploit hacking toolkit, confirmed that drive-by attacks are feasible in some situations.

After additional testing and tweaking of an exploit that was added to Metasploit earlier this week, Moore said he was able to conduct drive-by attacks that leveraged the shortcut flaw. But there are some caveats, he said in several e-mailed replies to Computerworld's questions.

"IE8 still requires confirmation before going from Internet zone to [a] WebDAV share," he said, referring to an Internet Explorer security setting. "It is an easy drive-by on IE6, but there is still user interaction with newer versions of IE."

The attack doesn't work when users browse with Mozilla's Firefox or Google 's Chrome, Moore said.

He also spotted different results that varied by the version of Windows running the PC, echoing comments from other researchers that drive-by attacks using IE6, IE7, IE8 and IE9 were successful on Windows XP, but not on the newer Windows 7 . "It looks like Windows 7 has some additional magic which creates a pop-up [warning], and I suspect Vista is the same," said Moore.

Also on Tuesday, Microsoft admitted that shortcut-based exploits could be embedded into Office documents, which would likely be delivered as e-mail attachments.

Microsoft promised to patch the problem, but has given no hint about when it will complete that work. The next regularly scheduled security updates are due to ship on Aug. 10.

In lieu of a patch, Microsoft has recommended that users disable the displaying of shortcuts in Windows. Yesterday it published an automated "Fix it" tool that lets users switch off shortcuts with a single click.

However, that advice effectively cripples the computer, something Microsoft acknowledged when it said turning off shortcuts would "impact usability" of the machine. Disabling shortcut transforms the usual graphical icons on the desktop and elsewhere into generic white icons, making it impossible for users to tell at a glance which will launch IE, and which represents a Microsoft Word document.

Moore remained confident that Microsoft would be able to quickly patch the problem, perhaps within two weeks.

"The core issue may be as simple as passing the LOAD_LIBRARY_AS_IMAGE_RESOURCE flag into the LoadLibrary() call used to map the DLL in order to extract the [shortcut] icon," he explained in another e-mail. "The question is whether the API used needs more than 'resource-only' access in order to function properly."

Users can access the Fix it tool that disables shortcuts from Microsoft's support site.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags MicrosoftsecurityWindowssoftwareoperating systems

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Best Deals on Good Gear Guide

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?