As exploits of the shortcut bug climb, company commits to ‘out-of-band’ update
By Gregg Keizer
Computerworld – Microsoft today said it will issue an emergency patch for the critical Windows shortcut bug on Monday, Aug. 2.
The company said that it is satisfied with the quality of the «out-of-band» update — Microsoft’s term for a patch that falls outside the usual monthly delivery schedule — but also acknowledged that it has tracked an upswing in attacks.
«In the past few days, we’ve seen an increase in attempts to exploit the vulnerability,» Christopher Budd, a spokesman for the Microsoft Security Response Center, said in a entry on the team’s blog. «We firmly believe that releasing the update out of band is the best thing to do to help protect our customers.»
Budd said that Microsoft would release the patch on Monday at approximately 1 p.m. Eastern.
Two weeks ago, Microsoft confirmed a flaw in how Windows parses shortcut files, the small files displayed by icons on the desktop, on the toolbar and in the Start menu that launch applications and documents when clicked. By crafting malicious shortcuts, hackers could automatically execute malware whenever a user viewed the shortcut or the contents of a folder containing the malevolent shortcut.
The bug was first described in mid-June by VirusBlokAda, a little-known security firm based in Belarus, but attracted widespread attention only after security blogger Brian Krebs reported on it July 15. A day later, Microsoft admitted that attackers were already exploiting the flaw using the «Stuxnet» worm, which targets Windows PCs that manage large-scale industrial-control systems in manufacturing and utility firms.
Exploit code has been widely distributed on the Internet, and Microsoft and others have spotted several attack campaigns based on the bug.
One of those campaigns apparently tipped the scales toward an early patch.
The Microsoft group responsible for crafting malware signatures to defend customers using the company’s antivirus products, including the free Security Essentials software, said that an especially nasty malware family had added exploits of the unpatched shortcut flaw to its arsenal.
«Sality is a highly virulent strain … known to infect other files, making full removal after infection challenging, copy itself to removable media, disable security, and then download other malware,» wrote Holly Stewart of the Microsoft Malware Protection Center, on the group’s blog Friday. «It is also a very large family — one of the most prevalent families this year. »
Sality’s inclusion of the shortcut exploit quickly drove up the number of PCs that have faced attack. «After the inclusion of the [shortcut] vector, the numbers of machines seeing attack attempts combining malicious [shortcuts] and Sality.AT soon surpassed the numbers we saw with Stuxnet,» said Stewart.
«We know that it is only a matter of time before more families pick up the technique,» she added.
Other security researchers had spotted Sality exploiting the shortcut bug earlier this week. On Tuesday, Trend Micro reported that the shortcut vector was being used not only by Sality, but also by other malware clans, such as the Zeus botnet-building Trojan.
As exploits of the shortcut bug climb, company commits to ‘out-of-band’ update
By Gregg Keizer
Computerworld – Microsoft today said it will issue an emergency patch for the critical Windows shortcut bug on Monday, Aug. 2.
The company said that it is satisfied with the quality of the «out-of-band» update — Microsoft’s term for a patch that falls outside the usual monthly delivery schedule — but also acknowledged that it has tracked an upswing in attacks.
«In the past few days, we’ve seen an increase in attempts to exploit the vulnerability,» Christopher Budd, a spokesman for the Microsoft Security Response Center, said in a entry on the team’s blog. «We firmly believe that releasing the update out of band is the best thing to do to help protect our customers.»
Budd said that Microsoft would release the patch on Monday at approximately 1 p.m. Eastern.
Two weeks ago, Microsoft confirmed a flaw in how Windows parses shortcut files, the small files displayed by icons on the desktop, on the toolbar and in the Start menu that launch applications and documents when clicked. By crafting malicious shortcuts, hackers could automatically execute malware whenever a user viewed the shortcut or the contents of a folder containing the malevolent shortcut.
The bug was first described in mid-June by VirusBlokAda, a little-known security firm based in Belarus, but attracted widespread attention only after security blogger Brian Krebs reported on it July 15. A day later, Microsoft admitted that attackers were already exploiting the flaw using the «Stuxnet» worm, which targets Windows PCs that manage large-scale industrial-control systems in manufacturing and utility firms.
Exploit code has been widely distributed on the Internet, and Microsoft and others have spotted several attack campaigns based on the bug.
One of those campaigns apparently tipped the scales toward an early patch.
The Microsoft group responsible for crafting malware signatures to defend customers using the company’s antivirus products, including the free Security Essentials software, said that an especially nasty malware family had added exploits of the unpatched shortcut flaw to its arsenal.
«Sality is a highly virulent strain … known to infect other files, making full removal after infection challenging, copy itself to removable media, disable security, and then download other malware,» wrote Holly Stewart of the Microsoft Malware Protection Center, on the group’s blog Friday. «It is also a very large family — one of the most prevalent families this year. »
Sality’s inclusion of the shortcut exploit quickly drove up the number of PCs that have faced attack. «After the inclusion of the [shortcut] vector, the numbers of machines seeing attack attempts combining malicious [shortcuts] and Sality.AT soon surpassed the numbers we saw with Stuxnet,» said Stewart.
«We know that it is only a matter of time before more families pick up the technique,» she added.
Other security researchers had spotted Sality exploiting the shortcut bug earlier this week. On Tuesday, Trend Micro reported that the shortcut vector was being used not only by Sality, but also by other malware clans, such as the Zeus botnet-building Trojan. Continuar leyendo «Microsoft sets emergency Windows patch for Monday»
-34.552356
-58.443076
Me gusta esto:
Me gusta Cargando...
Do you have files and folders on your computer that you absolutely don’t want anyone else to see? Or do you even carry important documents on those easy-to-misplace 
Notepad, a light-weight 
Gabriel Catalano® 
Debe estar conectado para enviar un comentario.