I am going to provide you with the summary from Ars Technica as it’s the clearest explanation of the problem I have seen:
The attack uses specially crafted shortcut (.lnk) files, which trick Windows into running code of an attacker’s choosing. Any Windows application that tries to display the shortcut’s icon—including Explorer—will cause exploitation, so even the mere act of browsing a directory with the malicious shortcuts is sufficient for a system to be exploited. Analysis suggests that the shortcuts are not improperly formed; rather they depend on a flaw in the way that Windows handles shortcuts to Control Panel icons.
The first reports of the problem came last month from Belorussian security company VirusBlokAda. The company found systems infected with the flaw through infected USB keys. The keys use the flaw to install a rootkit to hide the shortcuts, dubbed Stuxnet, including kernel-mode drivers, and a malicious payload. The rootkit is itself noteworthy: the drivers it installs are signed. The certificate used to sign them belongs to Realtek, suggesting that somehow the attackers have access to Realtek’s private key. The certificate used to sign the rootkit has now been revoked by Verisign.
The current in-the-wild attacks are using USB keys to distribute the shortcuts, but the attack could equally use network shares or local disks. The malware payload appears to be designed to specifically compromise the databases used by Siemens’ SIMATIC WinCC software. WinCC is SCADA software, used to control and monitor industrial systems, found in manufacturing plants, power generation facilities, oil and gas refineries, and so on. Siemens’ software uses hardcoded passwords, making attack particularly simple.
The best option for mitigating the flaw is to disable Windows’ ability to show shortcuts’ icons; details on how to do this are provided in Microsoft’s security bulletin. However, this mitigation comes at some cost; it removes all the icons from the Start menu, for example, which is sure to be detrimental to usability. Disabling Autorun provides slight protection, as it prevents Explorer windows from opening automatically when a USB key or CD is inserted.
This one has the potential to be very very bad. What I am going to do is put some of the links below. I am going to record a podcast tonight about this and have it posted in the next 24 hours. While the threat right now is low the potential for this one to explode is very very high. I do not get concerned about Windows exploits very often..this one has the very real potential to be on the scale of sasser, code red, or conficker. ECC is gearing up for this to be a widespread event and I am hoping it fizzles(which is dependent on a timely patch from Microsoft.) As of right now there is no anti-anything that will stop the .LNK vulnerability itself and any malware that appears WILL be able to leverage this before the a/v vendors can react as of right now. I am sure the security companies will be able to catch up..however we really need a patch from Microsoft on this one. The big problem for Microsoft is this is endemic to their ENTIRE codebase from Windows 95 on up. They have to now re-engineer every version of Windows to protect against this flaw. This is one time that if it takes Microsoft more than a week to come up with a fix there’s a very good reason. The following operating systems will NOT get a patch from Microsoft:
Windows 95
Windows 98
Windows ME
Windows NT
windows 2000(all versions)
Windows XP below SP3(this includes XP 64-bit which is now end of life..no support)
Windows VistaRTM (all versions). Vista SP1 is still supported until July 12 2011. You really should upgrade to SP2 of Vista.
I have some of the links below I have been following for this:
1
2
3
4
5
6
7
8
*UPDATE* Microsoft has posted their workaround. This nukes ALL shortcuts on the system though. If you want to guarentee your protection use this patch..but you won’t be able to easily launch anything.
*UPDATE 2*
Well the vulnerabilities threat profile has expanded:
If the .lnk is inside a document windows will execute the code. Again..i hope this fizzles..if it doesn’t I want folks to be aware.
*UPDATE3* List to this videocast from Steve Gibson..it’s well explained.
http://www.twit.tv/sn258
There are several attack vectors. It can be triggered via a webpage. it may even be able to be done from within any browser…not just IE. I just just got done informing a client that this could have many more attack vectors due to this being a problem with the core of windows.
*UPDATE 4* Normally I advocate caution in major patches. This hole however is so important that i am going to immediately patch and then workaround any issues this is going to cause. Again on mOnday htis patch gets released. PATCH IMMEDIATLY!!! Read the previous advisories I posted about this here.
